binder: A Channel might check its SecurityPolicy even after declaring termination

### What version of gRPC-Java are you using?
master/HEAD on any version of Android

### What did you expect to see?
Some reasoning/guarantee that a Channel will no longer call into its SecurityPolicy after it declares termination.

### Steps to reproduce the bug
One of many ways is to call `ManagedChannel.shutdownNow()` while it's establishing a new connection.

### Analysis
When using `AsyncSecurityPolicy`, `BinderClientTransport` calls `checkServerAuthorizationAsync()` while holding its `this` lock and only after carefully checking that it's not in state `SHUTDOWN` or `SHUTDOWN_TERMINATED`. This is safe because `clientTransportListener.transportTerminated()` is only called after transitioning into those states while holding the same lock. (We do this on the assumption that `AsyncSecurityPolicy` checks don't block)

However, when using an ordinary blocking `SecurityPolicy`, `checkServerAuthorizationAsync()` is implemented by `submit()`ing this presumably blocking work to `offloadExecutor`. We first do the same state checks, but because we release the `this` lock, the transport could shutdown and declare termination after this submission but before the offload executor actually calls `checkAuthorization()`.

まず BinderClientTransport の AsyncSecurityPolicy パスを読み、特に checkServerAuthorizationAsync()、checkAuthorization()、shutdownNow()、および transportTerminated() コールバックを確認します。offloadExecutor への送信と状態遷移を追跡し、終了後に認可が実行される可能性があるかを判断します。ライフサイクルの保証が確立され、回帰テストまたは明確に文書化された根拠によって裏付けられれば完了です。

索引モデルが issue の本文から書いたものです。