Provide torrc option to kill hidden service circuits after $TIMEOUT, $NUM_BYTES, or guard changes.

[mikeperry]

HTTP hidden services and other short-lived protocols do not need to keep their circuits open very long. Somewhere between 10min and 1 hour ought to be plenty. Since long-lived circuits are a vector for guard discovery (see #22728), we should provide a torrc option to set a max hidden service circuit lifetime.

Note that making this timeout too low effectively enables new forms of #20212, so we should err towards an hour for the timeout here until that fix is landed.

[mikeperry]

I can take this one, probably in December.

[mikeperry]

Other useful optional kill conditions include:

1. After a certain number of bytes (like a multiplier of a website's expected page size) have been sent on the circuit. Read and write should be separate params, since many services have much more data going in one direction than the other.
2. After the vanguard/pinned middle stops being used.

[nickm]

Per our triage process, these tickets are pending removal from 0.3.4.

[nickm]

These tickets, tagged with 034-removed-*, are no longer in-scope for 0.3.4. We can reconsider any of them, if time permits.