Rethink: cancellation, timeouts, accounting

[syntactically]

Currently, we have a strange set of primitives around cancellation and accounting, which mostly revolve around configuring a wall-clock "timeout" for a sandbox invocation, and then automatically killing it after that much time. We should endeavour to provide a more natural API, focused on the individual operations that need to be support in order to allow hosts to build their own cancellation logic; in particular:

• Rather than the current timeout-then-kill operation, we should expose a kill operation that can be run by the host from another thread or interrupt context
• We should expose CPU-time accounting metrics for a sandbox's total lifetime and for a single function call, including the ability to deliver interrupts to the host when selected CPU time thresholds are met.

[danbugs]

Related to #184