Fixed multi-cone search to handle interruptions carefully.

The ConeErrorPolicy class interface and implementations have been modified
so that any time the multi-cone thread is interrupted, it makes sure that
no more cone search queries are presented.  Previously, although
interruptions were checked for, it was only done when a successful
result was obtained, rather than when a query was made.  Especially
in the case that a service was failing (e.g. due to overload) that
could mean that the client kept on hammering the service with queries
whose results would never get looked at, until JVM shutdown.
topcat: ensure that ConeMatcher can be cancelled properly.

Modify the ConeMatcher class returns an object that can be run and
interrupted rather than returning a TableProducer with an
unreferenced thread that the caller cannot access.  This should fix
it so that hitting Stop in the multi-cone window really does shut
down all threads associated with the multi-cone sequence.
However, the STILTS coneskymatch could still in principle leave
threads running if the task is interrupted but the JVM is not shut down.
ttools: fix it so that skyconematch terminates threads on interrupt.
ttools: implement default limit on multicone parallelism.

There is now a limit defaulting to 10 and controlled by the
service.maxparallel system property which limits the number of parallel
threads that will be used to hit a server during a multicone-like query.
This should reduce inadvertent service overloading.