circuit_expire_building applies CBT in twisted ways on hidden service circuits

There is something wrong with how circuit_expire_building() applies timeouts to hidden services. There's some rather funky switch statements in there that grant hidden services a pass from timeout at certain stages in their handshaking, but not others. However, the end result seems to be that hidden service timeouts are actually more common than they should be for some reason. See my comments in #7157 (moved) for slightly more detail (though not much).