We won't use an L2 guard if it loses Stable, but we don't replace it

While debugging #40802, I ran into a fun edge case, where if one of our vanguards-lite loses the Stable flag, we will stop picking it as a middle hop, but in maintain_layer2_guards() we only replace it with a new one when it goes missing from the consensus entirely.

I think that means if all of our vanguards-lite lose the Stable flag (but stay Running) then we'll end up in a sad state where we fail to make any onion-service-related circuits.