The motivation here is to support an install mode where we stop as soon
as possible after one package fails, rather than going on as far as
possible with other packages.

To properly support this we need to be able to cancel jobs that have
been submitted but that have not yet been started. This is easy for the
serial JobControl but requires re-implementing the paralle JobControl.

In the previous impl we simply fork a thread immediately for each job
(and use a JobLimit externally to limit parallelim). The problem with
that is that all submitted jobs are actually executing, so there's no
way to cancel jobs that have not started yet (there are none). Combined
with the executeInstallPlan behaviour of exposing the maximum possible
paralleism this means that there can be a lot of jobs in progress
(though most waiting on the JobLimit), and none of them can be sanely
cancelled.

So in this impl we have a built-in maximum parallelism, so we're
executing at most that many jobs at once, while all others are waiting
to be executed. The ones that are waiting can be cancelled.

Because it's unspecified how many jobs can be cancelled, users can no
longer rely on counting the number of outstanding jobs so we add a new
method to check if there are any jobs remaining.

Subsequent patches will add tests and make use of these new features to
stop the install process as soon as possible after a failure, with a
new --keep-going flag to get the existing behaviour.