We need to extend our notion of "the origin of a guard" to include
"somewhere outside the guard list"; we need the ability to return a
FallbackDir as a Guard; and we need to remember a few more pieces of
information in each pending request.

As before, this commit may break compilation; it will be restored soon.

The guard manager is responsible for handing out the first hops of
tor circuits, keeping track of their successes and failures, and
remembering their states.  Given that, it makes sense to store this
information here.  It is not yet used; I'll be fixing that in
upcoming commits.

Arguably, this information no longer belongs in the directory
manager: I've added a todo about moving it.

This commit will break compilation on its own in a couple of places;
subsequent commits will fix it up.

This is more in keeping with the rest of our code.

This is the logical place for it, I think: the GuardMgr's job is to
pick the first hop for a circuit depending on remembered status for
possible first hops.  Making this change will let us streamline the
code that interacts with these objects.

Remove allow(clippy::disallowed_methods) lint flag.

See merge request tpo/core/arti!437

Make daemon tasks self-contained; introduce NetDirProvider

See merge request tpo/core/arti!436

The various background daemon tasks that `arti-client` used to spawn are
now handled inside their respective crates instead, with functions
provided to spawn them that return `TaskHandle`s.

This required introducing a new trait, `NetDirProvider`, which steals
some functionality from the `DirProvider` trait to enable `tor-circmgr`
to depend on it (`tor-circmgr` is a dependency of `tor-dirmgr`, so it
can't depend on `DirProvider` directly).

While we're at it, we also make some of the tasks wait for events from
the `NetDirProvider` instead of sleeping, slightly increasing
efficiency.

Don't use SystemTime::now()

Closes #306

See merge request tpo/core/arti!365

(Doing this a few days ahead of time to give updated code time to
get testing)

implement IsolationHelper for StreamIsolation

See merge request tpo/core/arti!434

Fixed typo on arti-client README.md

See merge request tpo/core/arti!432

arti-client, dirmgr: Initial DirFilter code

See merge request tpo/core/arti!431

Simplify DirFilter API

See merge request nickm/arti!1

This means you can write a DirFilter and only write code to mess with
the bits you want to.

Also, it is less code here.

There are two reasons why the DynFilter newtype might be needed:

1. To impl Default.  But we don't need it to impl Default since we can
have an accessor which does the defaulting.

2. To hide the API.  But this is usrely an unstable API.

Just writing Arc<dyn> gets rid of a lot of unnecessary boilerplate and
conversion code.

Abolish the handwritten Debug impl for DynFilter, which is no longer
needed.

Implement a periodic task scheduler, and a basic dormant mode

See merge request tpo/core/arti!429

but don't use it in a dyn Isolation context

This will make it possible to implement a directory-munging
mechanism in arti-testing for #397.

This code sits behind a feature flag, and can be used to modify
directories before storing them.  This is part of the implementation
for #397.

Addressing review comments: added some unit tests for the new scheduler
type, and made FireIn use an Instant instead (making it FireAt).

This is a revised version of !397; it implements a scheduling system for
periodic tasks that can be externally controlled, and then uses the
external control aspect to implement a basic dormant mode (#90).

More technically, the scheduling system consists of a `Stream` that
periodic tasks are expected to embed in a `while` loop or similar, a
way for tasks themselves to choose how long to wait until the stream
next yields a result, and a handle to control this outside of the task.

tor-proto: add the ability to learn clock skew from NETINFO cells

See merge request tpo/core/arti!410

We now check the handshake certificates unconditionally, and only
report them as _expired_ as a last resort.

(Rationale: if somebody is presenting the wrong identity from a year
ago, it is more interesting that they are presenting the wrong ID
than it is that they are doing so with an expired cert.

We also now report a different error if the certificate is expired,
but its expiration is within the range of reported clock skew.

(Rationale: it's helpful to distinguish this case, so that we can
blame the failure on possible clock skew rather than definitely
attributing it to a misbehaving relay.)

Part of #405.