Overhaul send_control_message

NB the branch is on top of !1365 (merged)

Fixes most of #917 (closed)

I think this (or something close to it) is about as good as we can get. It achieves these objectives:

• Can send zero messages, or more than one
• Can send messages from the handler
• Still enforces correct ordering of setup
• Makes wrong ordering during teardown reasonably unlikely

Work which I think we might still want to do:

• Should it take a "target hop" argument?
• Rename the cargo feature
• Change some of the names I have just invented
• Change the msg argument to start_... and send_message to be IntoIterator

Things I think we probably don't want to do:

• Stream-oriented API (this seems to invite many races); I deleted the commentary with these suggestions
• Avoid using tor_cell APIs here. I think using tor_cell here is precisely correct.