tls: route callback exceptions through error handlers

Wrap pskCallback and ALPNCallback invocations in try-catch blocks
to route exceptions through owner.destroy() instead of letting them
become uncaught exceptions. This prevents remote attackers from
crashing TLS servers or causing resource exhaustion.

Fixes: https://hackerone.com/reports/3473882
PR-URL: https://github.com/nodejs-private/node-private/pull/782
PR-URL: https://github.com/nodejs-private/node-private/pull/790
CVE-ID: CVE-2026-21637

Author: mcollina

test/parallel/test-tls-psk-alpn-callback-exception-handling.js

@@ -90,9 +90,7 @@ describe('TLS callback exception handling', () => {
       }
     }));
 
-    server.on('secureConnection', common.mustNotCall(() => {
-      reject(new Error('secureConnection should not fire'));
-    }));
+    server.on('secureConnection', common.mustNotCall('secureConnection should not fire'));
 
     await new Promise((res) => server.listen(0, res));
 
@@ -137,9 +135,7 @@ describe('TLS callback exception handling', () => {
       }
     }));
 
-    server.on('secureConnection', common.mustNotCall(() => {
-      reject(new Error('secureConnection should not fire'));
-    }));
+    server.on('secureConnection', common.mustNotCall('secureConnection should not fire'));
 
     await new Promise((res) => server.listen(0, res));
 
@@ -185,9 +181,7 @@ describe('TLS callback exception handling', () => {
       }
     }));
 
-    server.on('secureConnection', common.mustNotCall(() => {
-      reject(new Error('secureConnection should not fire'));
-    }));
+    server.on('secureConnection', common.mustNotCall('secureConnection should not fire'));
 
     await new Promise((res) => server.listen(0, res));
 
@@ -228,9 +222,7 @@ describe('TLS callback exception handling', () => {
       }
     }));
 
-    server.on('secureConnection', common.mustNotCall(() => {
-      reject(new Error('secureConnection should not fire'));
-    }));
+    server.on('secureConnection', common.mustNotCall('secureConnection should not fire'));
     await new Promise((res) => server.listen(0, res));
 
     const client = tls.connect({
@@ -259,9 +251,7 @@ describe('TLS callback exception handling', () => {
 
     const { promise, resolve, reject } = createTestPromise();
 
-    server.on('secureConnection', common.mustNotCall(() => {
-      reject(new Error('secureConnection should not fire'));
-    }));
+    server.on('secureConnection', common.mustNotCall('secureConnection should not fire'));
 
     await new Promise((res) => server.listen(0, res));
 
@@ -303,9 +293,7 @@ describe('TLS callback exception handling', () => {
 
     const { promise, resolve, reject } = createTestPromise();
 
-    server.on('secureConnection', common.mustNotCall(() => {
-      reject(new Error('secureConnection should not fire'));
-    }));
+    server.on('secureConnection', common.mustNotCall('secureConnection should not fire'));
 
     await new Promise((res) => server.listen(0, res));