To limit rate increase of inbound conns
Add exemption system so inbound tunnel builds bypass the throttler

by checking if a peer qualifies when adding, rather than
iterating through the whole netdb to generate an exclusion list at the start.
This was very inefficient and generated needless lookup storms via lookupBeforeDropping()
Same idea for getClosetHopExclude()
Goal is to never iterate through all the known routers, profiles, or connected peers
to select peers for a single tunnel.
Add ExcluderBase and 4 classes for various cases:
Excluder, ClosestHopExcluder, IBGWExcluder, and OBEPExcluder.

Change CSFI.getEstablished() from a Set to a List for efficiency
Improve efficiency of selectActivePeersNotFailingPeers()
by iterating through connected list rather than profiles.
Do not add not-connected peers to exclude set,
which would become huge for hidden routers.

Change getExclude() to shouldExclude()
The exclude set calls shouldExclude() in contains().
Pass the exclude set to ProfileOrganizer.

For client tunnels, do OBEP and IBGW checks at peer selection time,
not afterwards in ConnectChecker, so it doesn't fail at the end in checkTunnel().

Check closest hop when hidden.
Fail-fast for inbound when no connected peers and hidden, do not fall back to non-connected peers.
Should improve startup time for hidden routers.

Use ArraySet for matches to save space
Remove unused selectPeersLocallyUnreachable() and selectPeersRecentlyRejecting()

No peer selection policy changes here.

Command error handling and message improvements
Implement simple HELP command
bump -1

Update checklist to specify bootclasspath, so these are caught in the future
bump -16-rc

This will probably also reduce builds at startup.
Limits may require tweaks after further testing.

Javadoc fixes
Log tweaks

Kill handlers at shutdown

- Set cache size based on connection limit
- Track average inbound cache eviction time
- Set inbound expiration based on cache time
- Reduce max inbound expiration
- Fix saving inbound token sent after relay response or hole punch
- Dont send or save tokens if we are symmetric natted
- Sort persisted tokens by expiration so they are expired in correct order on reload
- Periodically expire tokens from cache
- Add getters to Token class
- Add missing case IPV4_SNAT_IPV6_UNKNOWN to EnumSets

log tweaks

Wasn't passing through user and realname fields
Pass through RFC 2812 mode field if present
reported by RN

Don't hexdump for RI errors
Don't throw ISE when sending 2nd retry

and drop packets received on them, to prevent SSU1 fallback processing

Requires re-saving user/pw on proxy side

test code that was off by default was previously checked in

reported, fixed, and tested by zlatinb