Implement "shutdown" functionality for arti-client

In order to complete the implementation of #1849 (closed) (protover enforcement), we need the ability to cause a running Arti client to shut down. Something related to this might also be needed for a more general implementation of #71 / #90 (dormant mode).

Any design suggestions would be welcome.