CNodeState was added for validation-state-tracking, and thus, logically, was protected by cs_main. However, as it has grown to include non-validation state (taking state from CNode), and as we’ve reduced cs_main usage for other unrelated things, CNodeState is left with lots of cs_main locking in net_processing.
This starts the process of moving things out of cs_main (and into a new CPeerState) starting with nDoS and rejects.
This also solves the lowest-hanging fruit by wiping out 10+ (!) cs_main locks that are trivial to remove! It further removes a cs_main lock which is taken on every ProcessMessages iteration, which makes a future rebase of #12934 much more effective by being able to move onto the next peer for processing (at least sometimes) while a block is validating.