Implement IRP cancellation

[cl91]

Several issues we need to consider:

1. When a driver crashes, what happens to the IO packets queued on the driver, and what happens to the outstanding IO requests that the driver has made (to other drivers).
2. In particular, we need to correctly handle the case where one driver calls another driver which then calls the first driver.
3. The important issue is maintaining consistency of server-side and client-side identifiers. If we delete a server-side IO packet and later reassigns the same identifier pair to another (server-side) IO packet, the client must know it's dealing with a new one. The same applies to file objects and device objects (we send notifications to client drivers to inform it when server-side objects get deleted).

[cl91]

Partially done in c0ad594

[cl91]

After much work and multiple rounds of late-night debugging, driver crashing should no longer crash the server, so closing this.