async: separate cancelation from exceptions

[timbertson]

This is a big one, I'm happy to walk through the module face-to-face sometime if you'd like.

Essentially, cancel should not be an exception for a couple of minor reasons:

• it's too easy to accidentally catch it, a try will discard a cancelation signal and the code may carry on as a leaked strand
• it means all async code can also throw other exceptions, you can't see from the types whether it throws a "real" exception

But also one big reason: it should be possible to defer cancelation. This allows code to implement "critical sections" where they won't get canceled. You don't need this for exceptions because your critical section should be written carefully not to throw exceptions, but it's not possible to write uncancelable code (unless you forbid yielding, which isn't practical).

The existing code allowed this via individual callbacks (using cancelable=False), but using that requires dealing with callbacks. Now you can wrap an arbitrary async expression in defer-cancelation and know that the block won't be interrupted in the middle, cancelation will be delayed until after the block has completed.

There's precedence for these cancelation semantics, the one I'm most familiar with is cats-effect, there's an interesting thread here going over the rationale for this model.

I've added fairly extensive tests so I'm fairly confident in the new semantics 🤞. And I've added comments to explain the reasoning of why things are structured in a certain way, thus the rather high line-count.

There's one outstanding issue I haven't been able to solve, which is that asyncx should not include st<global>. I mentioned this in discord, but I haven't been able to make a more minimal reproduction yet to demonstrate the issue.

[TimWhiting]

Koka 3.2.0 seems to have broken this :(

[timbertson]

@TimWhiting I added a test case "cancelation and finalization both occur with aborting effect", which works as hoped 🎉