Graceful shutdown timeouts

This change allows graceful shutdown attempts to time out. If we're closing connections more because we suspect they might be dead, it stands to reason that sending a known-bad notification to shut down might leave connections in limbo, too.

This depends on #116.
It doesn't look like we've checked the `gracefulShutdownTimeoutHandler` to see if the graceful shutdown attempt has in fact timed out. Is the `shutdownNotification` indicative of a `gracefulShutdownTimeoutHandler` (I would expect that it is not, since they seem to operate independently)?