allow high latency spawners

such as VMs, batch and cloud services, etc. which can take minutes to start.

- Spawner.start_timeout sets a limit for true failure, at which point spawner should be considered dead.
- Handler.spawn_single_user only waits up to 10 seconds before returning. It can now return with a spawner still pending.
- Record User.spawn_pending state, and render 'pending' page while server is starting but not started.