Implement more orderly termination of XmppServer

Move the call to TcpServer::Shutdown back to DeleteActor::Shutdown as
we no longer accept incoming sessions if the XmppServer is deleted.
The latter is a more watertight fix than calling TcpServer::Shutdown
immediately.

Use a mutex to prevent a race condition where the main thread triggers
deletion of the XmppServer and an IO thread accepts a new session and
creates a new XmppServerConnection as a dependent of the now deleted
XmppServer.

Add Terminate method to clear any leaked TcpSessions and shutdown the
WorkQueue.  This is mostly paranoia because the WorkQueue is expected
to have been drained before LifetimeManager destroys the XmppServer's
DeleteActor.

Change-Id: I3acb3889f15c616ad85a2716a147552c43a55ecd