The double free would occur if
1) some thread invoked Cancel() to queue destruction of a ProxyIostate,
   and
2) before that packet was processed, the ProxyIostate's handler ran and
   decided to destroy itself.

Bug: ZX-4060
Change-Id: I3b9c7275c4e0cd2dc3a6c6cd2d2376c947eb627a

This moves the ProxyIostate and ConnectionDestroyer types into their
own files, and feeds them async dispatchers via injection rather than
environmental globals.

Change-Id: Ifeadbed02e92a7e2a7af5346ddd253af74112abf