mds: refine shutdown, add ::stopping

mds: refine shutdown, add ::stopping

Add a ::stopping flag, set at start of suicide(),
that other contexts must inspect after taking
mds_lock.

This guards against the possibility of multiple
threads entering suicide, and more generally
against the possibility of other procedures
starting while we're in the middle of shutting down.

Signed-off-by: John Spray <john.spray@redhat.com>