netstack: don't ACK SYNs in TIME-WAIT

It was possible for a SYN to arrive after the endpoint sent an ACK as part of
the transition to TIME-WAIT, but before returning from handleSegmentsLocked().
This caused the SYN to be dequeued and ACK'd despite the change in
EndpointState.

Deflakes TestTCPTimeWaitNewSyn.

Tested with:
blaze test --config=gotsan --runs_per_test 10000 \
  //third_party/gvisor/pkg/tcpip/transport/tcp:tcp_x_test -j 2000 \
  //  --test_filter TestTCPTimeWaitNewSyn

PiperOrigin-RevId: 380639808

pkg/tcpip/transport/tcp/connect.go

@@ -1130,7 +1130,7 @@ func (e *endpoint) handleReset(s *segment) (ok bool, err tcpip.Error) {
 func (e *endpoint) handleSegmentsLocked(fastPath bool) tcpip.Error {
 	checkRequeue := true
 	for i := 0; i < maxSegmentsPerWake; i++ {
-		if e.EndpointState().closed() {
+		if state := e.EndpointState(); state.closed() || state == StateTimeWait {
 			return nil
 		}
 		s := e.segmentQueue.dequeue()

pkg/tcpip/transport/tcp/rcv.go

@@ -559,7 +559,6 @@ func (r *receiver) handleTimeWaitSegment(s *segment) (resetTimeWait bool, newSyn
 	//    (2) returns to TIME-WAIT state if the SYN turns out
 	//      to be an old duplicate".
 	if s.flags.Contains(header.TCPFlagSyn) && r.RcvNxt.LessThan(segSeq) {
-
 		return false, true
 	}