There is a race condition between Tenant::shutdown's defuse_for_drop loop and offload_timeline, where timeline offloading can insert into a tenant that is in the process of shutting down, in fact so far progressed that the defuse_for_drop has already been called.

This prevents warn log lines of the form:

offloaded timeline <hash> was dropped without having cleaned it up at the ancestor

The solution piggybacks on the offloaded_timelines lock: both the defuse loop and the offloaded timeline insertion need to acquire the lock, and we know that the defuse loop only runs after the tenant has set its TenantState to Stopping.

So if we hold the offloaded_timelines lock, and know that the TenantState is not Stopping, then we know that the defuse loop has not ran yet, and holding the lock ensures that it doesn't start running while we are inserting the offloaded timeline.

Fixes #10070