because the push phase of unpending happens outside the tree lock, we
need to ensure only one thread is ever entering unpending

this is in preparation for future changes, right now, unpending is only
ever called from the topreq thread

This is the first step towards bringing back safe front pushes: For a
thread in vdp_push bytes, it is safe to push upwards if it owns all
ST_OPEN T_NEXUS nodes upwards or if they are ST_CLOSED or ST_DELIVERED.

more to come in later commits

it is only needed in the esi parser and for some sanity checks

much of the rest of the unpend design and state management assumes that
nexuses got nodes below.

By all means we do not want to start removing nodes from the tree,
because that would introduce even more sync or races with unpending, so
the logical solution is to turn the node into a zero T_DATA node.

ref: 5a03b1ef

we do need to differentiate the cases here, depending on which one, we
need to fini the task before or after some other action.

once the subreq is picked up by delivery, it could no longer be true

sometimes accounting is missing 8 bytes - we would expect:
ReqAcct "^29 0 29 192 104 296$

because, when this happens, the subreq accounting and the response
are correct, I assume this to be an issue in varnish-cache

at esi_level==0, accounting is not our busines, only on higher levels we
need to account when pushing bytes up so ReqAcct contains the bytes
produced by that layer.

we will be using it again, but slightly differently