Fix nasa#950, race condition in control request

Because the process of handling a control request involves
calling other subsystems, the ES lock needs to be released.
However, this also means that the app record can change state
for other reasons, such as the app self-exiting at the same
time.

To avoid this possibility, process in two phases:

First assemble a list of tasks that have timed out
and need to be cleaned up, while ES is locked.

Next actually perform the cleanup, while ES is unlocked.
In areas during cleanup that need to update the ES global,
the lock is locally re-acquired and released.