Ensure that onion services are shut down when their handle is dropped.

This is distinct from #1231 , though many of the notes there will apply.