Avoid same-family bugs with guards, and chosen exits

When a chosen exit is given, and guards are currently in use Arti may currently build paths where the guard shares a family with the exit. This happens because of a limitation in the way that GuardRestriction is implemented: we can't look at the family of the provided exit, because we don't have access to a NetDir when we're checking that restriction later on.

Some possible implementations here include:

• putting a hashset containing the entire family into the GuardRestriction.
• somehow giving the GuardMgr::expire_and_answer_pending_requests() code access to a NetDir. (See #161 (closed))