proto: Explicitly enforce maxima on SENDME windows.
No actual bug here, just technical debt:
For SendWindow
s, our tag system already ensured that we rejected
any SENDME that didn't correspond to an appropriate drain. Still,
it doesn't hurt to check.
For RecvWindow
s, it would have been a protocol violation if we
ever did this, but it makes sense to make it an internal error if we
try.
Part of #1383 (closed).