Cleanup shutdown cancel path after use

Since private xenstore paths are now UUID-based, a shutdown cancel path persist
across a localhost migration. This causes a following localhost migration to
fail: the cancel path that still exists causes the cancellable watch that waits
for the domain to ack the shutdown request to fire immediately, and cancel the
migration.

We solve this by moving all cancel-related xenstore keys out of the
"/xapi/\<uuid\>" tree and into its own domid-based xenstore tree. We then zap
this tree on domain destroy.

Signed-off-by: Rob Hoes <rob.hoes@citrix.com>