Error handling in timers unified with apps RFC

Consider this a Request for Comment. I am myself not completely satisfied with this patch... suggestions?

389fc91 extracts the error handling code from `core.app` to its own module `core.restarts`.

fdf7f83 modifies `core.timer` to use `core.restarts` and extends it to do so. `timer.new()` now requires an additional "app" argument which can be an app or `nil`. If it's an app, the timer is "owned" by that app. If the app dies, its timers will be prevented from being run and removed from the timers table when it is restarted. If an app-owned timer raises an error, its app will be marked dead. If a "loose" timer raises an error, the error is printed (no other action is taken).
Calls to `timer.new()` throughout the code base have been updated.

What I do not like about this:

* Using the new `timer.new()` is clumsy: If you pass it `self` (e.g. the class) instead of the app instance all hell breaks loose.
* I have to use `C.get_monotonic_time` in `core.restarts` because I don't have `core.app`'s `now()`. Extract `core.clock`?
* The refactoring is not very *elegant* in general.
* Owned and loose timers behave quite differently.

Example of an owned timer.