binder: A Server might check its SecurityPolicy even after declaring termination

### What version of gRPC-Java are you using?
master/HEAD on any version of Android

### What did you expect to see?
Some reasoning/guarantee that a `BinderServerTransport` will no longer call into its SecurityPolicy after it declares termination.

### Steps to reproduce the bug
One of many ways is to call call `shutdownNow()` while it's processing the first call to one of its services.

### Analysis
`BinderServerTransport` has this problem when using either `AsyncSecurityPolicy` or ordinary `SecurityPolicy`. It checks these policies from the `BinderTransportSecurity.ServerAuthInterceptor` which runs on the server's `executor()` without coordination or synchronization with the transport. A call to `shutdownInternal()` w/`forceTerminate=true` can move the transport to `SHUTDOWN_TERMINATED` and call `ServerTransportListener#transportTerminated` with streams still in-flight.

Trace BinderServerTransport.shutdownInternal(), BinderTransportSecurity.ServerAuthInterceptor, and the transport executor to understand how termination overlaps security-policy checks. Check the ServerTransportListener#transportTerminated path and the forceTerminate case; done means the behavior is defined and verified for both AsyncSecurityPolicy and ordinary SecurityPolicy after shutdownNow().

Written by the indexing model from the issue text.