CircMgr: retire_circuits() does not affect pending circuits.

From #650 (closed).

I've found a bug in the existing "retire circuits" code: it does not affect in-progress circuits. Those circuits can still succeed, and if they do, they will announce themselves to any pending circuit requests.

It's a bit tricky to avoid a race condition here.

We could either:

• Add a way to cancel in-progress pending circuits.
• Add a generation counter to the circuit manager, so that an earlier-generation circuit is never a good answer for the current generation.

I kind of lean towards the second as easier to reason about.