Timing out when a cancelled process takes too long to die

### Things to check first

- [X] I have searched the existing issues and didn't find my feature already requested there

### Feature description

Currently, when a running `Process` is cancelled, `anyio` simply does:

```python
self.kill()
with CancelScope(shield=True):
await self.wait()
```

However, in pathological cases, the killed process may take arbitrarily long to actually exit, resulting in the program hanging indefinitely. I therefore request the ability to specify a timeout for the "wait" above; if the process doesn't exit in time, a dedicated error is raised so that the program can continue cleaning up and the programmer can know what went wrong.

### Use case

We recently ran into a situation where some child processes got stuck in "uninterruptible sleep" (as reported by `ps`). As a result, when the timeouts we had wrapped them in expired, our program ended up hanging waiting for the subprocesses to acknowledge their deaths. We would prefer it if our program were to exit with an informative error message when this happened rather than just stalling forever.