Shut down with known-bad notification

The APNs protocol doesn't acknowledge successful notifications, so it's hard to know what's been accepted and what hasn't when a connection is shut down by the client. The APNs gateway *does* report errors, though, and closes the connection whenever something goes wrong. That behavior provides a circuitous, but more certain way of shutting connections.

The strategy introduced in this pull request is to write a known-bad notification to the APNs gateway and then wait for the remote host to close the connection. In the meantime, previously-written notifications may fail and get re-enqueued. When the known-bad notification is finally rejected, we know that everything sent before that point has been accounted for and everything else in the sent message buffer hasn't been processed yet.

TODO:

- [x] Come up with a non-crazy strategy for timing out on shutdown - 908c26b