Supply better and less frequent warnings on circID exhaustion

Fixes the surface behavior of #11553
Switch to random allocation on circuitIDs.

Fixes a possible root cause of 11553 by only making 64 attempts at
most to pick a circuitID.  Previously, we would test every possible
circuit ID until we found one or ran out.

This algorithm succeeds probabilistically. As the comment says:

  This potentially causes us to give up early if our circuit ID
  space is nearly full.  If we have N circuit IDs in use, then we
  will reject a new circuit with probability (N / max_range) ^
  MAX_CIRCID_ATTEMPTS.  This means that in practice, a few percent
  of our circuit ID capacity will go unused.

  The alternative here, though, is to do a linear search over the
  whole circuit ID space every time we extend a circuit, which is
  not so great either.

This makes new vs old clients distinguishable, so we should try to
batch it with other patches that do that, like 11438.
Merge remote-tracking branch 'public/bug11553_024' into bug11553_025

Conflicts:
	src/or/channel.h
Diagnostic warning to see if it's pending destroys causing 11553
Add a rate-limiter for the other circuitID exhaustion warning
Merge remote-tracking branch 'public/bug11553_024' into bug11553_025
Improvements to #11553 fix based on review

Use a per-channel ratelim_t to control the rate at which we report
failures for each channel.

Explain why I picked N=32.

Never return a zero circID.

Thanks to Andrea and to cypherpunks.
Merge remote-tracking branch 'public/bug11553_024' into bug11553_025

Conflicts:
	src/or/circuitbuild.c
Merge remote-tracking branch 'public/bug11553_025'