rpc_binder: Prevent RpcServer shutdown deadlock

RpcServer::~RpcServer invokes shutdown() to trigger exit from all
join and session threads. The function waits for the number of
connections to drop down to zero, but this depends on RpcSession
promoting a wp<RpcServer> to sp<RpcServer>. Since this is happening
during the destructor, when the refcount is zero, this pointer
promotion fails. As a result, the list of connections may not be fully
cleared and the thread calling shutdown() will deadlock.

Fix this by forcing users to call shutdown() earlier and panicing
otherwise.

Bug: 263168076
Test: cleanly shutdown RpcServer with many connections
Change-Id: Ia67a4a839419aafb1bd47fb93ed2e76d56b107c2