Don't send DESTROY to circID 0 when circuit_deliver_create_cell fails

Cypherpunks found this and wrote this patch.

Fix for 12848; fix on (I think) d58d4c0d, which went into 0.0.8pre1
Add an extra check in channel_send_destroy for circID==0

Prevents other cases of 12848.
Fix another case of 12848 in circuit_handle_first_hop

I looked for other places where we set circ->n_chan early, and found
one in circuit_handle_first_hop() right before it calls
circuit_send_next_onion_skin(). If onion_skin_create() fails there,
then n_chan will still be set when circuit_send_next_onion_skin()
returns. We should probably fix that too.
Merge remote-tracking branch 'public/bug12848_024' into maint-0.2.5

Conflicts:
	src/or/circuitbuild.c
Merge remote-tracking branch 'origin/maint-0.2.5'