limit congestion control timeout amplification

[jacobkaufmann]

we have observed that the congestion control timeout can amplify quickly to the point where the timeout becomes not so useful. for example, the timeout should not exceed the maximum idle timeout.

summary:

• add a maximum timeout field to congestion control
• limit the number of timeouts registered with congestion control by the connection
• add a maximum timeout field to the connection config
  • by default, this value is equal to the max idle timeout

[jacobkaufmann]

@carver this should address some of the issues raised in #69