deps,test: fix undici globals on frozen globalThis

[mhayk]

Summary

When Object.freeze(globalThis) is called before any undici-backed global (fetch, WebSocket, Response, etc.) is accessed for the first time, the lazy initialisation inside setGlobalDispatcher throws:

TypeError: Cannot define property Symbol(undici.globalDispatcher.2),
           object is not extensible

This is particularly problematic because the Node.js security best practices guide explicitly recommends Object.freeze(globalThis) as a defence against monkey-patching (CWE-349).

Root cause

setGlobalDispatcher unconditionally calls Object.defineProperty(globalThis, ...). When globalThis is not extensible the call throws instead of degrading gracefully.

This became observable after globals were made lazy-loaded in #45659.

Fix

Wrap the Object.defineProperty calls in setGlobalDispatcher with a try/catch. When globalThis is not extensible the dispatcher is stored in a module-level fallback variable. getGlobalDispatcher is updated to return globalThis[symbol] ?? fallbackDispatcher so the normal (extensible) path is unchanged.

deps/undici/undici.js (the bundled file) is updated to match the source change in deps/undici/src/lib/global.js.

Test

A new test test/parallel/test-undici-frozen-globalthis.js is added that:

1. Calls Object.freeze(globalThis) before any undici globals are touched
2. Asserts that fetch, WebSocket, Response, Request, Headers, and FormData are all accessible without throwing

Checklist

• make -j<N> build succeeds
• New test passes: ./node test/parallel/test-undici-frozen-globalthis.js
• Existing fetch/WebSocket tests pass
• Normal setGlobalDispatcher / getGlobalDispatcher behaviour is unchanged

Fixes #46788

[nodejs-github-bot]

Review requested:

• @nodejs/security-wg

[shrujalshah28]

This change should go to - https://github.com/nodejs/undici, and once it has a new version with your changes merged, it will be included here.

[mhayk]

Thanks for the feedback! You're absolutely right, the fix should go upstream first.

I'll close this PR and create a PR in the undici repository with the same fix. Once it's merged and a new version is released, it can be integrated into Node.js via the standard dependency update process.

Closing in favour of upstream fix.