Reject repeated activation of the same extension session

[OskarEichler]

Summary

Reject repeated server responses for the same client extension, including extensions that use no reserved bits. A single session must not be activated or inserted into the message-processing stack twice.

Reproduction and verification

# With an offered extension named 'ext' whose rsv1/rsv2/rsv3 are false:
exts.generate_offer
exts.activate('ext, ext') # raises WebSocket::Extensions::ExtensionError

Focused duplicate-response reproduction passes; existing reserved-bit conflict and negotiation-order examples remain green. The framework documents one response parameter set per extension and creates one client session per name.

• Ruby 4.0.6 through rbenv; existing current-upstream suite: 64 examples, zero failures on this isolated change.
• The cumulative release-based candidate passes 283 focused checks (272 baseline failures → zero), 2,784 model checks, the current upstream's 64-example suite, and gem build/extraction.
• The historical 0.1.5 suite has three Ruby keyword-versus-options-hash mock failures on both baseline and candidate. Current upstream already corrected those expectations; they were run against the candidate through an external preload without changing repository tests.
• No new or modified tests/specs, following the consumer repository's explicit policy. Reproductions/models were run from external scratch scripts.

Breaking changes and limitations

Intentional behavior correction: duplicate activation previously slipped through for zero-RSV extensions and ran the same transformer twice. It now raises ExtensionError.

Only local Ruby 4.0.6/macOS execution is claimed; the repository's older Ruby/JRuby matrix needs upstream CI. No production access or unrelated release upgrades.