Exceptions in expand() corrupt the TransformHierarchy

Discovered recently during unrelated work that when a composite PTransform (Java) crashes during expand - for example due to a validation failure - it leaves the Pipeline in a state that throws NPEs when it is traversed.

No one has complained, so it doesn't seem critical to fix the mutation logic. But we should set a bit and poison all future uses of the corrupted pipeline.

Imported from Jira [BEAM-2583](https://issues.apache.org/jira/browse/BEAM-2583). Original Jira may contain additional context.
Reported by: kenn.

Inspect the Java Pipeline and TransformHierarchy handling around composite PTransform expansion, using the reported validation-failure scenario as the starting case. Trace what happens after expand() throws and determine how later traversal currently reaches the corrupted state. Done means future uses of a pipeline affected by that failure are rejected rather than producing traversal NPEs.

Written by the indexing model from the issue text.