Malicious Conflux Endpoint Can Leave Stale Global OOO Queue Accounting After Teardown

Tor's Conflux OOO queue accounting can remain inflated after a Conflux set is torn down. A malicious Conflux-capable endpoint relay can send a real `CONFLUX_SWITCH` gap followed by `RELAY_DATA` cells, causing the client to queue out-of-order messages. When teardown happens before normal dequeue, …

total_ooo_q_bytes += cost;
cfx->ooo_q_alloc_cost += cost;