proxy-server: Reject `destroy()` during active calls and calls after `destroy()` #382

Fixes #378

There are 2 issues with non-libmultiprocess clients:

1. After a destroy(), any request can still be sent as long as the capability is not dropped. Such request dereferenced a null m_impl pointer (reset by the previous destroy() call) and crashed the server (also reported in bitcoin/bitcoin#36502).
2. Sending destroy() while another request on the same object was running could free m_impl while that request was still using it.

The libmultiprocess C++ client cannot trigger either case because it sends destroy() only from the ProxyClient destructor and releases the capability after that.

This PR implements the fixes suggested in the issue.

• serverInvoke checks m_destroyed and rejects requests received after destroy() with "method called after destroy".
• invokeDestroy checks m_active_calls and rejects destroy() with "destroy called while other calls are in progress" when another request on the object is being executed.

Differences from the suggestion:

• No mutex is needed because m_active_calls and m_destroyed are accessed only from the event-loop thread.
• Only requests with an mp.Context are counted in m_active_calls. Requests without one run to completion on the event-loop thread, so destroy() cannot run during their execution.

Also added a regression test that manually builds and sends requests with Cap'n Proto, reproducing the behavior of a buggy non-libmultiprocess client.

<!--e57a25ab6845829454e8d69fc972939a-->

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

<!--021abf342d371248e50ceaed478a90ca-->

Reviews

See the guideline and AI policy for information on the review process. A summary of reviews will appear here.

<!--5faf32d7da4f0f540f40219e4f7537a3-->

#381 fixes the OpenBSD job failure. I'm working on a fix for the gnu32 one.

EDIT: Opened #383 to fix the gnu32 failure. It makes shell.nix compile capnproto with GCC too when an i686 platform is detected.