refactor tcpquota and pipeline refs; allow special-case overrun in isc_quota

- if the TCP quota has been exceeded but there are no clients listening
  for new connections on the interface, we can now force attachment to the
  quota using isc_quota_force(), instead of carrying on with the quota not
  attached.
- the TCP client quota is now referenced via a reference-counted
  'ns_tcpconn' object, one of which is created whenever a client begins
  listening for new connections, and attached to by members of that
  client's pipeline group. when the last reference to the tcpconn
  object is detached, it is freed and the TCP quota slot is released.
- reduce code duplication by adding mark_tcp_active() function
- convert counters to stdatomic

(cherry picked from commit a8dd133d270873b736c1be9bf50ebaa074f5b38f)
(cherry picked from commit 4a8fc979c4)

lib/ns/interfacemgr.c

@@ -423,8 +423,9 @@ ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
 	 * connections will be handled in parallel even though there is
 	 * only one client initially.
 	 */
-	ifp->ntcpaccepting = 0;
-	ifp->ntcpactive = 0;
+	atomic_init(&ifp->ntcpaccepting, 0);
+	atomic_init(&ifp->ntcpactive, 0);
+
 	ifp->nudpdispatch = 0;
 
 	ifp->dscp = -1;