Whitelist rt_sigaction and sigaction syscalls.
Should fix a SIGSYS on termination via SIGTERM with glibc.
In terminate_flush_to_(remote|client), instead of closing the socket
associated with the other half of the duplex, shut down receives so
that the fds all remain valid until all socket operations are complete.
Then the termination will close out all of the socket fds and reclaim
the empty pipes if possible.
Make pipe_close() close the TCP sockets before reclaiming the pipes.
There's no need to do the elaborate cancel then close-or-shutdown
dance, and I suspect it may be producing the bad fd errors because
of the asymmetry of the shutdown or close on the exit path.

The odd exit path with the shutdown is an artifact of the time before
terminate_flush_to_(remote|client) existed.
Clean up socket close code to ensure that both the client and remote
sockets are always both cancelled, then both shutdowned, then both
closed.  This ordering ensures that no asynchronous handlers could
ever run on a socket that has been closed.

Before the code was more flexible and made it possible to close
a single socket, but doing so could easily break the underlying
assumptions about socket validity in the producer/consumer asio
handlers.  Now it is easier to verify correct behavior.
Create and use a close_paired_sockets() helper.
terminate_flush_to_(remote|client) must cancel other running handlers.
Unify terminate_flush_to_(remote|client)() into flush_then_terminate().

There is no reason for only one half of the connection to be terminated,
except in the exceptional case of flushing out queued data that still
lives in the splice pipe buffer before the sockets are closed.
Properly handle flush_then_terminate() being called multiple times on a
single connection.  On subsequent calls, it will check to see if the
background flush is complete, and if so, it will terminate().
Add a terminate_if_flushed() helper.
The non-splice case needs a flush_then_terminate() to be defined.
flush_then_terminate() does need a direction specifier.  This required so
that data is not flushed to a socket that has already signalled that it
is closed by returning an error or 0==eof.

We also support flushing both directions at once, but it generally
is not needed, except perhaps at shutdown.
Make FlushPipeAction:: into an enum class.  No functional change.