Expire half-open streams, possibly using a timer?
Right now, when we send an END on a stream, there might be potential for that stream's StreamEnt::HalfSent
to stick around indefinitely (or at least, for the lifetime of the circuit) if the other side doesn't also send an END.
Perhaps we should expire these on a timer or something; we should check what Tor does.