don't let recently_chosen_ntors overflow

with commit c6f1668d we let it grow arbitrarily large.

it can still overflow, but the damage is very small now.
Revert e443beff and solve it a different way

Now we explicitly check for overflow.

This approach seemed smarter than a cascade of "change int to unsigned
int and hope nothing breaks right before the release".

Nick, feel free to fix in a better way, maybe in master.
collect and log statistics about onionskins received/processed

we skip onionskins that came from non-relays, so we're less likely to
run into privacy troubles.

starts to implement ticket 9658.
Merge branch 'maint-0.2.4'