Terminating threads with pthread_kill is wildly unsafe

Currently using `pthread_kill` with any signal except `SIGCANCEL` will violently kill the thread by terminating its worker and freeing its pthread struct without running any cleanup. Since worker termination is asynchronous, this can cause UAF bugs if the terminated worker accesses its pthread struct before dying. Further, killing a thread in this manner without running the TSD destructors can leave the program in an inconsistent state and potentially lead to deadlocks.

If we can get away with it, it would be nice if we could avoid supporting violently killing threads at all. If we must have it, perhaps it should be implemented as a variant of async cancellation to at least avoid the UAF bug.