nexus 'quiesce' support

See RFD 459.

For graceful removal, Nexus needs internal APIs to control its "quiesce" state. In an ideal world there'd be a couple of states:

start quiescing:

• the external server socket is closed immediately
• for the external API, open TCP connections are closed as soon as there is no longer an outstanding request on them. (idle connections closed immediately; connections with requests in progress should closes when the next request completes, or as soon as possible after)
• maybe: we stop doing background tasks?

after a few seconds, or when all connections are closed:

• No new sagas can be created -- 503s are generated instead.

At this point it's fully quiesced. It'd still be handling internal API requests. That's needed to monitor and control the quiesce state, if nothing else. I'm also assuming our own internal stuff will be better about handling 503s.

Nexus needs an internal API endpoint for monitoring this, too:

• whether it's quiesced, and if so, which if the above two states it's in?
• how many TCP connections are open, for which servers, and how many requests are outstanding on each one
• how many sagas are running

In terms of implementation: we might need to store this in the database? Otherwise if Nexus restarts, it won't remember it's supposed to be quiesced. We could store it locally instead, but I can't think of a reason not to put it into the database. And if that's where it is, I'm not sure we need the internal API at all, except maybe to tell it to re-read its config.

Start by reading RFD 459 and the issue's proposed Nexus quiesce states and monitoring requirements. The work is complete only when the design and implementation support graceful external connection removal, prevent new sagas when fully quiesced, and expose the required monitoring or control behavior.