Refactor cgroups::internal::Freezer.

The Freezer tries to converge to the "FROZEN" state by repeatedly (every
100 ms) writing "FROZEN" to the freezer.state control file. It assumes
there are two possible reasons why a process does not get frozen during
an attempt:

1. It was in the middle of being forked and did not receive the signal;
it will receive it at the next attempt.

2. It is in uninterruptable sleep ("D" state). Normally, this is from
device I/O or paging and is shortlived, in which case it'll be frozen on
retry. However, processes can get stuck in "D" state, either because of
a device issue, incorrect OOM handling, or kernel bugs. Under this
scenario the correct behavior is to fail after a timeout (defaults to 60
seconds).

Freezer functions have been namespaced under cgroups::freezer.

Review: https://reviews.apache.org/r/20817
Refactored cgroups::destroy to use a single pass.

internal::Destroyer now uses a single pass of freeze, kill, thaw, reap
to kill all processes in a freezer cgroup. cgroups::destroy will not
complete until all processes have been reaped.

Added tests for destroying a freezer cgroup containing a stopped
process or a traced process.

Review: https://reviews.apache.org/r/20818
Use a timeout to discard cgroups::destroy.

A default duration of 60 seconds is used before a cgroups::destroy is
discarded.

Review: https://reviews.apache.org/r/22064