More robust CancelScope misnesting prevention

@agronholm brought this case up on Gitter:

import trio

async def main():
    async def shim(fn, *args):
        fn(*args)

    scope = trio.CancelScope()
    async with trio.open_nursery() as nursery:
        nursery.start_soon(shim, scope.__enter__)

    async with trio.open_nursery() as nursery:
        nursery.start_soon(shim, scope.__exit__, None, None, None)

trio.run(main)

I think we should probably error here. I took a look at the code and I think the issue is that our CancelScope misnesting prevention only works within a single task -- that is, we don't check that there's no CancelScope currently entered at the end of any task. Unfortunately, IIRC that's hard in that situation to raise an exception with a nice stack trace. As a stopgap, we could raise when exiting the nursery if anything gets marked as misnested. (... which would raise later but should catch all of these misnestings?)

I'm making mostly unsubstantiated conjectures here, based on a few minutes of playing around with the code. There's very likely something I missed!

Start with CancelScope.enter and exit, then trace nursery teardown as used in the reproducer. Run the provided cross-task misnesting example and inspect how scope state is tracked across tasks. Done means this misnesting is detected and raises an error, either at scope exit or nursery exit, with tests covering the behavior.