fix: guard sessionStorage read in Socket constructor

[mandarini]

Summary

Defense-in-depth fix for the bug reported in supabase/supabase-js#2331.

socket.js:62 reads global.sessionStorage via a bare property access. In sandboxed iframes without allow-same-origin, certain in-app webviews (Facebook Messenger, Instagram, Google Performance Max), and "block third-party storage" privacy modes, the property getter itself throws SecurityError before || short-circuit evaluation completes — taking down the entire Socket constructor synchronously.

This wraps the read in try/catch so the constructor cannot throw. Behavior is unchanged in every path that previously worked: null is the fallback, and downstream call sites already guard this.sessionStore && this.sessionStore.getItem(...) (socket.js:394, 396).

Test plan

• Existing phoenix tests continue to pass.
• Manual: in DevTools, override window.sessionStorage getter to throw, then construct new Socket(...) — expect no throw.

Note: source-only change. Bundled assets under priv/static/ need a separate rebuild commit (per recurring fix: rebuild assets pattern, e.g. 8b8c7b2).