Move cancellation into Downstairs, using a token to kill IO tasks (#1329)

The IO tasks are now cancelled by a
`tokio_util::sync::CancellationToken`, instead of a oneshot channel.

The token is wrapped in a `tokio_util::sync::DropGuard` and held in the
`ConnectionState`, meaning the IO tasks are cancelled automatically when
we drop the `ConnectionState` – no more accidentally forgetting to stop
them!

Downstairs connection replacement is now handled in the `Downstairs`
itself, rather than in the IO task. Previously, the downstairs
replacement process was as follows:

- `Downstairs::promote_to_active` notices that replacement is necessary
- Downstairs signals to the old IO task on the `oneshot`
- IO task receives this signal in its loop
- IO task locks the `Downstairs` and calls
`Downstairs::on_new_connection_replacing`, then exits

Now, it looks like the following:

- `Downstairs::promote_to_active` notices that replacement is necessary
- `Downstairs` calls `on_new_connection_replacing` directly
  - The previous `ConnectionState` is removed and dropped
  - This automatically cancels the IO task

This puts tricky replacement logic in just one place, and makes the IO
task simpler: from its perspective, it just gets cancelled.

Author: mkeeter