Add an isolate_client() function to create an isolated TorClient.

When two TorClients are isolated, their streams shouldn't share circuits, even though they share internal circuit and guard state.

This branch additionally expands the stream isolation machinery so that two tokens can apply to the same stream: one per-stream and one per-client.

This is related to #150 (closed), but not at all a complete solution.