Close security gaps found in a spec review #88

Gaps I found while reading the spec again with security in mind.
Most of them are about pairing, input sent by the other side of the connection, and what a web page or another device on the same network can do.

• Make a reused Sentinel or pairing PSK a pairing protocol error spec#311
• Clarify when the pairing round count resets spec#312
• Arbitrate every activation and gate audio on playback spec#314 or Fix multi-server admission gaps and gate audio on playback spec#315 (tracked in Should a held pairing connection that adds the playback activity trigger arbitration? spec#299)
• Reject browser connections on the client's WebSocket listener spec#324
• Say that the pairing token is a credential spec#327
• Bound dynamic pairing rounds on the server side spec#328
• Treat peer-sent names and metadata as plain text spec#330
• Limit min_buffer_ms to 0-5000 spec#313
• Close the connection on malformed binary messages spec#321
• Allow receivers to limit fragmented message and artwork sizes spec#322
• Limit where servers and clients connect after mDNS discovery spec#325
• Cap client-sent text fields in UTF-8 bytes spec#329