Document TOCTOU race in findUnusedPort()

Add a comment to findUnusedPort() explaining why the TOCTOU race
between closing the ServerSocket and the caller's connect attempt
is acceptable. Every caller is a negative test that expects the
connection to fail, so a stolen port produces the same outcome.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: mtopolnik

core/src/test/java/io/questdb/client/test/cutlass/qwp/client/LineSenderBuilderWebSocketTest.java

@@ -725,6 +725,11 @@ private static void assertThrowsAny(Runnable action, String... anyOf) {
         }
     }
 
+    // There is a TOCTOU race between closing the ServerSocket and the caller's
+    // connect attempt — another process could bind the port in between. This is
+    // acceptable because every caller is a negative test that expects the connection
+    // to fail. If the port is stolen, the test connects to a non-QuestDB endpoint,
+    // which also fails with the same error.
     private static int findUnusedPort() throws Exception {
         try (java.net.ServerSocket s = new java.net.ServerSocket(0)) {
             return s.getLocalPort();