Add null check in WindowTimeoutWithBackpressureSubscriber.onNext() to handle hot publishers that emit before downstream request().

Elements are dropped gracefully using Operators.onNextDropped() when window hasn't been created yet, maintaining backpressure semantics.

Fix potential NullPointerException in FluxWindowTimeout when hot publishers emit before downstream requests

This change improves the robustness of FluxWindowTimeout by adding a defensive null check for the window field in the onNext() method. While this scenario is rare and typically indicates upstream spec violation, the fix prevents application crashes and provides graceful degradation by safely dropping data using Operators.onNextDropped().

The issue occurs in WindowTimeoutWithBackpressureSubscriber.onNext() where this.window can be null if onNext() is called before the downstream subscriber calls request(). This can happen when:

1. A hot publisher violates the Reactive Streams specification by emitting data immediately upon subscription without waiting for demand signals
2. Custom publishers don't properly implement backpressure handling
3. Edge cases in publisher implementations that bypass normal flow control

The window field is initialized to null and only gets assigned in the drain() method, which is triggered by downstream request() calls. If a spec-violating publisher calls onNext() before any request(), accessing window.sendNext(t) results in NPE.

Root cause analysis:

• Line 187: final InnerWindow<T> window = this.window; - can be null
• Line 188: if (window.sendNext(t)) - NPE if window is null
• The window is created in drain() method which is called from request()
• Hot publishers may emit before any request() is made

Solution:
Added null check before accessing window.sendNext(t). If window is null, the data is safely dropped using Operators.onNextDropped() with appropriate context, maintaining system stability while logging the dropped element for debugging.

This follows Reactor's defensive programming principles and improves the operator's resilience against spec-violating upstream publishers, similar to other operators in the codebase that include such protective measures.