fix: resend cached WHOAREYOU on any retry

[bomanaps]

PR Description

The discv5 conformance test TestHandshakeResend fails on every consumer of this library because the responder issues a fresh WHOAREYOU on each retry instead of resending the original this PR makes the responder resend the cached challenge byte-for-byte when a session is mid-handshake, and relaxes the initiator's nonce check to accept any recently-sent outbound (bounded), with NodeSession tracking the set and NodeSessionManager cleaning up the index on teardown.

Verified locally: 7/7 green on the hive devp2p/discv5 suite against a Besu image built on this branch the 8th subtest (PingMultiIP) is excluded because it fails identically on every client locally due to a Docker cross-bridge SNAT artifact rather than any client bug.

Fixed Issue(s)

---

Note

Medium Risk
Changes handshake/nonce validation behavior and session nonce indexing, which can affect discovery connectivity and state cleanup if incorrect. Scope is contained to discv5 session management with added bounds and tests mitigating risk.

Overview
Improves discv5 handshake retry conformance by resending the earliest cached WHOAREYOU (byte-for-byte) when an unauthorized packet arrives while a session is in WHOAREYOU_SENT, even if the retry uses a different per-packet nonce.

Updates initiator-side validation to accept incoming WHOAREYOU if its nonce matches any of the session’s bounded set of recent outbound nonces (instead of only the latest), adds NodeSession tracking for those nonces, and updates NodeSessionManager teardown/index maintenance to clean up all tracked nonces.

Extends unit tests to cover the new resend fallback behavior and the new resendFirstPendingWhoAreYou helper.

^{Reviewed by Cursor Bugbot for commit 0d57674. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[bomanaps]

I have read the CLA Document and I hereby sign the CLA

[bomanaps]

Closing as duplicate of #234