Intro points can get stuck in CIRCUIT_PURPOSE_S_ESTABLISH_INTRO
When a hidden service opens an introduction point circuit, there's nothing that checks that it actually receive an INTRO_ESTABLISHED cell within a reasonable timeout.
So in remove_invalid_intro_points(), we should close circuits that have been in CIRCUIT_PURPOSE_S_ESTABLISH_INTRO for too long (60 seconds? 5 minutes? Some dynamic interval?).