Handle linked connections better during bootstrap

begindir connections advance directly to the CLIENT_SENDING state, even before their TLS connection is created.

So we need to modify the logic from legacy/trac#4483 (moved) that checks for consensuses that are downloading:

• is it a direct connection in state after connecting, or
• a linked connection that's attached, or
• a linked connection that's in a state after sending

And then do the standard "extra consensus download check" when we're about to link a directory connection to a TLS connection.

Or arma may have a better idea.

I am not sure whether we should fix this in 0.2.8, because the current code works, but it's not optimal when too many TLS connections hang. Tagging it just in case.