Classify errors by severity and discard messages that cannot be read

[KevinWahle]

Changes

BrokerError was a flat enum so the client turned anything out of tick() into a shutdown.

Each error type now answers severity(), Fatal or NonFatal or Programming, Borderline cases are non-fatal, since guessing wrong that way costs a log line while guessing wrong the other way stops an operator that had no need to stop.
Along the way three variants that were never constructed are gone, IoError became ConnectError with an explicit BindError at the two startup sites, Other retired into LocalChannelForOwnId, and ReceivedMessage::Error is removed since nothing ever produced it.

Severity on its own would only convert a crash into a permanent stall, because a message that failed to parse was never removed and came back on every tick, leaving the process alive, logging and doing nothing. Messages that cannot be read are now discarded before the error travels, so a bad message costs one tick instead of the queue forever, and store_in_msgs skips a message it cannot key rather than rolling back the whole batch.