Send and receive DESTROY cells correctly

Arti currently doesn't send DESTROY cells when circuits close; it doesn't notice that circuits close when they are dropped. I should fix both of those problems.

Additionally, ISTR that we have some notion of recently destroyed circuits where we accept cells for a little while until we don't any more. We should implement that too, and make sure there's a spec for it.

• Handle incoming DESTROY cells correctly
• Send DESTROY cells when a circuit closes
• Send DESTROY cell when a circuit is dropped.
• Make sure that if a DESTROY cell goes out, we don't send any more on the circuit.
• Make sure all circuit objects get closed if a channel dies or is shut down.
• Make sure we have an appropriate means for handling for what Tor handles with channel_mark_circid_unusable().
• Make sure we have an appropriate means for handling for what Tor handles with channel_note_destroy_pending().
• Do the right thing for handling incoming cells to an unrecognized circuit.