chore: comment mqtt-v5 username/password

Highlight:
This version of the protocol allows the sending of a Password with no User Name, where MQTT v3.1.1 did not.

refer:
https://docs.oasis-open.org/mqtt/mqtt/v5.0/os/mqtt-v5.0-os.html#_Toc3901044

> 3.1.2.9 Password Flag
> Position: bit 6 of the Connect Flags.
>
> If the Password Flag is set to 0, a Password MUST NOT be present in the Payload [MQTT-3.1.2-18]. If the Password Flag is set to 1, a Password MUST be present in the Payload [MQTT-3.1.2-19].
>
> Non-normative comment
>
> This version of the protocol allows the sending of a Password with no User Name, where MQTT v3.1.1 did not. This reflects the common use of Password for credentials other than a password.

writeToStream.js

@@ -201,6 +201,8 @@ function connect (packet, stream, opts) {
   // Password
   if (password != null) {
     if (!providedUsername && protocolVersion !== 5) {
+      // `username` is not required when password is present in MQTT-v5
+      // see also: https://docs.oasis-open.org/mqtt/mqtt/v5.0/os/mqtt-v5.0-os.html#_Toc3901044
       stream.destroy(new Error('Username is required to use password'))
       return false
     }