This fixes a potential segfault, among various other likely-related
issues, which all occur because TLSSockets were not informed if their
underlying stream was closed in many cases.

This also significantly modifies an existing TLS test. With this change
in place, that test no longer works, as it tries to mess with internals
to trigger a race, and those internals are now cleaned up earlier. This
test has been simplified to a more general TLS shutdown test.

Currently the test fails only in a couple of environments (Mac & ASan)
reliably, even though it passes reliably in all others. The failures are
due to emitted errors on the client H2 stream (not the focus of this
test). I'm hoping here that that's due to a timing different in those
environments, and scheduling the shutdown like this instead will
guarantee the order so that doesn't happen any more.