Take every down peer out of the table in one walk (closes #225)

The prefix handler ran one PeerDown per peer, one after another. When
the sessions of several peers went down together, their walks queued up.
A returning full-table peer's messages stayed held back while the walks
ahead of its own ran, and could reach the limit of 20,000.

The table's PeersDown now takes several peers out of every prefix in one
walk. One walk runs at a time. The next one takes every peer whose
session went down since the previous one began. The doc of
maxHeldBackMessages says how long a peer's messages are held back. The
limit is now 150,000 messages, about 150 MiB. The status page shows how
many messages each handler holds back.

Model: opus-5-5

README.md

@@ -652,7 +652,7 @@ What happens at each limit:
 
 - Held-back messages: the prefix handler holds back a peer's messages after the
   peer's session goes down. It applies them once the peer has left every prefix.
-  It holds at most 20,000 such messages (`maxHeldBackMessages`), about 20 MiB.
+  It holds at most 150,000 such messages (`maxHeldBackMessages`), about 150 MiB.
   At that number it takes nothing more off its queue until it has applied one of
   them.