Graceful shutdown timeouts

This change allows graceful shutdown attempts to time out. If we're closing connections more because we suspect they might be dead, it stands to reason that sending a known-bad notification to shut down might leave connections in limbo, too.

This depends on #116.
> Is the `shutdownNotification` indicative of a `gracefulShutdownTimeoutHandler`…?

It is not. It *is* an indication that we've attempted a graceful shutdown in the past, though.

> It doesn't look like we've checked the `gracefulShutdownTimeoutHandler` to see if the graceful shutdown attempt has in fact timed out.

Well, the thinking here is that we'll only have one `IdleStateHandler` in play at a time. If we get an `IdleStateEvent` before we've attempted a graceful shutdown (i.e. `shutdownNotification` is `null`), we know that it's the idle state handler for connection inactivity. Since we remove the connection inactivity handler in `shutdownGracefully` and since `shutdownGracefully` is `synchronized`, we know that:

1. We'll never get an `IdleStateEvent` for an idle connection after the idle connection handler has fired and called `shutdownGracefully`.
2. If we *do* get an `IdleStateEvent` with a `null` `shutodownNotification`, it's definitely from the graceful shutdown timeout handler.

Seem crazy?