GHSA-52rh-5rpj-c3w6: Improper handling of multiline messages in node-irc

The vulnerability stemmed from improper handling of CR characters in message splitting. The original action method (Client.action) directly used text.split(/\r?\n/), which didn't split on standalone CR (\r). The _splitMessage function was also vulnerable due to the same flawed regex. The patch introduced proper splitting logic in _splitMessage (using /\r\n|\r|\n/) and reused it in Client.action, confirming both functions were involved in the vulnerability. The CR handling failure allowed command injection via unprocessed carriage returns.