onion-tunnel: rework and cleanup VirtualDevice and other stuff

The headline change here is that VirtualDevice's implementation is now vastly different (and hopefully better!). We now clearly delineate the path packets will take; they now are queued in the "unprocessed" buffer, shown to the main loop, and then released from the "processed" buffer when the main loop says it's okay to do that.

The codebase was also tidied up, documented, and hopefully generally improved.