plimsoll v0.17.4

Fixes from reviews of v0.17.3: the warm pool is charged against the memory budget, a refused open no longer moves the pool's language mix, the docker provider's Drain waits for every session it found open, and the pool never rebalances away a language sessions still ask for.

Sessions

• The warm pool counts against SANDBOX_TOTAL_MEMORY_MB. A waiting container holds memory (its limit is one run's) but no concurrency slot, and neither plimsolld's clamp nor WithAdmission charged it, so with a pool the budget no longer bounded what sandboxes hold. Each waiting container is now charged one run: plimsolld clamps SANDBOX_MAX_CONCURRENT to the budget's runs less the pool's size and refuses to start when no run would fit, and WithAdmission charges the pool when it starts and gives the charge back after Drain.
• An open the docker provider refuses (a floor it cannot meet, say) no longer counts toward the pool's language mix; an open counts once it passes the floor. Before, a caller repeating refused opens could move the pool toward its languages. plimsolld checked the floor earlier, so this reached only embedders.
• The docker provider's Drain reports success only once every session it found open has been removed. A session whose lifetime ran out, or whose caller closed it, at the moment Drain ran could be skipped, so Drain returned with its container still there, and could misuse a counter in a way Go reports as a panic.
• The warm pool's rebalancing never removes a container warming a language set that at least a quarter of recent sessions ask for, since a claim will take it. In v0.17.3 a pool of 2 whose demand sat near that threshold replaced such a container about once a minute.
• docs/sessions.md, "A warm pool", now says what a split pool does not keep warm: a language fewer than a quarter of recent sessions ask for, and concurrent opens that empty the pool, can find their interpreter cold in an already running container.

Upgrading

• With SANDBOX_TOTAL_MEMORY_MB and SANDBOX_SESSION_POOL both set, plimsolld admits that many fewer concurrent runs, and refuses to start if the pool leaves no room for one.

Clients

• @plimsollmark/client and the Python client are at 0.17.4, unchanged apart from the version.