Kill out-of-memory gears more aggressively to reduce downtime

This change does a few things differently:

* Make multiple attempts when reading or writing cgroup
  data, to get around lock contention.  Also, handle
  exceptions better in this process

* Avoid calling force stop on the gear, because this
  involves other possible locking problems, and almost
  never works on an OOM gear, even when we bump the memory
  limit.  This also eliminates the time window between
  stopped and started states where someone/something could
  execute a conflicting state change.

* Send kill signals before we bump memory, so that the
  existing processes should immediately start cleaning
  up when the memory limit is bumped, without doing
  anything else like accepting more connections.