SocketManager: fix unregistering next timer in the ready list

Reviewer: @harshsin

If a timer unregistered the timer after it in the ready list, we'd crash 
because LIST_FOREACH_SAFE saved a pointer to the next entry. The underlying 
problem is that we're iterating over a list where any element can be removed
by the timer callback.

The fix is to treat the ready list as a queue. The slight difficulty is that 
timers with a different priority level need to remain on the ready list. Doing 
this while treating the ready list as a queue requires a temporary list.

Now a ready timer can be either on the real ready list or a temporary list. 
This has gotten complicated enough that I added an explicit state to the timer 
entry so the rest of the code knows whether ready_links or timer_wheel_entry 
is valid.