shutdown: manage connections before shutting down executors

[yaauie]

The previous implementation of shutdown relied on the shutdown of the top-level worker group causing the bound channel to not be able to execute any events, which effectively prevented the bound channel from receiving any more connections. It didn't actually close the channel

This had a side effect of causing existing connections to crash noisily as one or more handlers in the pipeline relied on the top-level executor group and submitted work to a closed executor. I believe it also had a side-effect of crashing the bound channel, which is how it stops listening.

By closing the connections first (in a reasonable order, server first), we can ensure that the connections are closed and that their channel pipelines will not submit work to executors that will reject them.

This change applies the guidance from netty docs "Simplify shutdown process with ChannelGroup".

---

Perhaps worth noting, the Server here has non-threadsafe code in Server#listen to support reuse of the plugin shutdown if it is already running. I don't believe that this code is accessible, nor that it would reliably work reliably due to the lack of threadsafety, but have not made pairwise changes to that unusual shutdown sequence.