control::serve documents that the first request on a connection must be
`auth` and that anything else closes the connection. A first line that
wasn't valid JSON got a parse error but left the connection open, unlike a
wrong token or a non-auth request. Close it in that case too; after a
successful auth a malformed line still just gets the parse error.
Adds control::transport_tests::malformed_input_before_auth_closes_the_connection,
which fails before this change.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
