BrooklynNode entity safe STOP effectors

Effectors to stop BrooklynNode forcing the user to choose explicitly whether to stop the running apps or not. Refuse to STOP if there are existing children (possibly mirroring nodes added by another entity)
dunno about you but i feel that the logic here is messy (my fault) and getting messier (your fault :) ) --

i wonder if the arguments and semantics should be something like:

* `stopAppsFirst` -- whether apps are stopped or left running (as is, default false)
* `forceShutdownOnError` -- whether to shutdown the system if apps fail to stop or timeout (default false)
* `shutdownTimeout` -- a maximum delay to wait for apps to gracefully stop before giving up or forcibly exiting (default 20s)
* `httpReturnTimeout` -- a maximum delay to wait for apps and mgmt context to stop before returning from the REST call; if this is >= the shutdownTimeout and the shutdownTimeout is exceeded the call will return with an error (and setting > shutdownTimeout has no difference to setting =shutdownTimeout) (default 20s)
* `delayForHttpReturn` -- a delay applied after the REST call is returning and before any `System.exit`, to permit the REST response to be returned (default 5s)

If there is an error stopping apps before restTimeout, or the httpReturnTimeout >= the shutdownTimeout and any app shutdown calls did not return, then the call returns an error.  If force is true, it invokes the `mgmt.terminate` and `System.exit` sequence after `shutdownTimeout+delayForHttpReturn` the `delayForHttpReturn`.

Just thinking aloud ... wdyt?  If you think this is overkill for now, maybe just paste these comments (or your thoughts on it) in the code for discussion at a later date.