thread-system: hold on to the NgxThreadSystem forPermitThreadStarting()

Retry of #277 , which I was too hasty in merging.  Fixes the possibly undefined behavior in the initialization list that we had before.

PSOL has:

```
RewriteDriverFactory::RewriteDriverFactory(ThreadSystem* thread_system) {
#ifdef NDEBUG
  // For release binaries, use the thread-system directly.
  thread_system_.reset(thread_system);
#else
  // When compiling for debug, interpose a layer that CHECKs for clean mutex
  // semantics.
  thread_system_.reset(new CheckingThreadSystem(thread_system));
#endif
  Init();
}
```

Which means that when you compile it with with `Release=DEBUG` then `static_cast<NgxThreadSystem*>(thread_system())` is no longer valid and so you get #237 : "check failed: may start threads".

By adding a local `ngx_thread_system_` to `NgxRewriteDriverFactory` we can still call through to `PermitThreadStarting` even though all other calls using `thread_system()` will go via a `CheckingThreadSystem`.