Move timeout handler to after frame decoder

Mitigates attacks like the one described in SpigotMC/BungeeCord#3066. This cannot be considered a full protection, only a mitigation that expects full packets. The attack described is essentially the infamous Slowloris attack.

proxy/src/main/java/com/velocitypowered/proxy/network/BackendChannelInitializer.java

@@ -48,10 +48,10 @@ public class BackendChannelInitializer extends ChannelInitializer<Channel> {
   @Override
   protected void initChannel(Channel ch) throws Exception {
     ch.pipeline()
+        .addLast(FRAME_DECODER, new MinecraftVarintFrameDecoder())
         .addLast(READ_TIMEOUT,
             new ReadTimeoutHandler(server.getConfiguration().getReadTimeout(),
                 TimeUnit.MILLISECONDS))
-        .addLast(FRAME_DECODER, new MinecraftVarintFrameDecoder())
         .addLast(FRAME_ENCODER, MinecraftVarintLengthEncoder.INSTANCE)
         .addLast(MINECRAFT_DECODER,
             new MinecraftDecoder(ProtocolUtils.Direction.CLIENTBOUND))

proxy/src/main/java/com/velocitypowered/proxy/network/ServerChannelInitializer.java

@@ -53,11 +53,11 @@ public class ServerChannelInitializer extends ChannelInitializer<Channel> {
   @Override
   protected void initChannel(final Channel ch) {
     ch.pipeline()
+        .addLast(LEGACY_PING_DECODER, new LegacyPingDecoder())
+        .addLast(FRAME_DECODER, new MinecraftVarintFrameDecoder())
         .addLast(READ_TIMEOUT,
             new ReadTimeoutHandler(this.server.getConfiguration().getReadTimeout(),
                 TimeUnit.MILLISECONDS))
-        .addLast(LEGACY_PING_DECODER, new LegacyPingDecoder())
-        .addLast(FRAME_DECODER, new MinecraftVarintFrameDecoder())
         .addLast(LEGACY_PING_ENCODER, LegacyPingEncoder.INSTANCE)
         .addLast(FRAME_ENCODER, MinecraftVarintLengthEncoder.INSTANCE)
         .addLast(MINECRAFT_DECODER, new MinecraftDecoder(ProtocolUtils.Direction.SERVERBOUND))

proxy/src/main/java/com/velocitypowered/proxy/server/VelocityRegisteredServer.java

@@ -102,10 +102,10 @@ public class VelocityRegisteredServer implements RegisteredServer, ForwardingAud
           @Override
           protected void initChannel(Channel ch) throws Exception {
             ch.pipeline()
+                .addLast(FRAME_DECODER, new MinecraftVarintFrameDecoder())
                 .addLast(READ_TIMEOUT,
                     new ReadTimeoutHandler(server.getConfiguration().getReadTimeout(),
                         TimeUnit.MILLISECONDS))
-                .addLast(FRAME_DECODER, new MinecraftVarintFrameDecoder())
                 .addLast(FRAME_ENCODER, MinecraftVarintLengthEncoder.INSTANCE)
                 .addLast(MINECRAFT_DECODER,
                     new MinecraftDecoder(ProtocolUtils.Direction.CLIENTBOUND))