Play Framework

fix: suppress benign post-handshake connection resets on the TLS pipeline (release 1.13.62)

PF-172: PF-109's SslHandshakeExceptionSuppressor self-removes on a successful
handshake and PF-110's PlainHttpExceptionSuppressor is only installed on the
plain-HTTP pipeline, so steady-state resets on the HTTPS port had no suppressor.
Browsers racing h3 against h2 tear down the losing connections with TCP RST; on
the h2 leg the parent channel has no catch-all (PlayHandler is per-stream) and
Http2ConnectionHandler re-fires anything without an embedded Http2Exception, so
the reset reached DefaultChannelPipeline's tail and logged the "reached at the
tail of the pipeline" WARN. On the http/1.1 leg it surfaced as an empty-message
ERROR from SslPlayHandler.

Adds SslSteadyStateExceptionSuppressor, installed after the handshake suppressor
so PF-109 keeps first refusal during its window and inherits the same position
once it removes itself — one handler covers both ALPN outcomes. It does not
self-remove, and checks SSLException first so genuine TLS faults still propagate.

Also extracts the reset/broken-pipe match, which had become a third private copy,
into play.server.BenignIoExceptions.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013x22fbvuNq3BfFLcDSfWDM