We can choose duplicate/overlapping L2 vanguards
In maintain_layer2_guards() we make sure that when we're adding new L2 guards, none of these L2 guards overlap with each other. But we don't check that these new L2 guards don't overlap with our existing L2 guards.
That is, when we're picking all 4 of our L2 guards on the first run it is fine. But if we have 4, we drop 2, and we add 2 new ones, then it could be the case that these 2 new ones are the same relays as the 2 we kept.
At the extreme version, we could over time end up with all 4 of our L2 guards being the same relay.