Add cow::ReadScope

[brson]

ReadScope will address two unsafe aspects of COW: 1) Handles that exist after the cow::Scope is destroyed segfault when used; 2) There is no enforcement of owneship over the aux pointers, leading to races and other badness if they are used from multiple tasks.

We will begin assuming that there is only a single writer task and a single reader task (at any given time). Multiple readers are handled with a patient parent solution.

There will be a WriteScope and, at any given time, 0 or 1 ReadScopes. The write scope cannot be destroyed until after the outstanding ReadScope is destroyed, enforced with messages in destructors. A new ReadScope is created every time layout is performed. The existence of a ReadScope takes the place of reader_forked/reader_joined, eliminating another source of error.

To prevent sharing of aux pointers we will do several things:

1. Make ReadScope un-sendable
2. Give the WriteScope a ReadScopeTaskKey that indicates which task may use a ReadScope.
3. Creating the ReadScope will need to be done through an affine ReadScopeFactory instance that contains the key.
4. Exactly what happens when the reader fails is unclear. There needs to be a safe way to clean up the aux pointers and indicate to the WriteScope that the ReadScopeTaskKey can be changed.

[brson]

This also prevents writers from using reader pointers since the task key will prevent the writer from instantiating the ReadScope.

[metajack]

No more cow.