common/TrackedOp: make OpHistory::on_shutdown() idempotent

Make on_shutdown() idempotent using shutdown.exchange(true) to ensure
thread shutdown and join happens exactly once, even if on_shutdown() is
called multiple times.

The atomic exchange returns the previous value of shutdown:
- If it was already true, return early (already shut down)
- If it was false, proceed with shutdown: break_thread(), conditionally
  join if started, and clear history containers

Add an is_started() check before joining the opsvc thread in on_shutdown().
This prevents attempting to join a thread that hasn't started yet, making the
shutdown process safe for rapidly created and destroyed objects.

Add history.on_shutdown() call in OpTracker destructor as a failsafe,
with documentation explaining that on_shutdown() should be called before
destruction. The idempotent design makes this safe even if on_shutdown()
was already called explicitly during shutdown sequences in OSD::shutdown(),
Monitor::shutdown(), MDSRank::~MDSRank(), and DaemonServer::~DaemonServer().

Fixes: https://tracker.ceph.com/issues/76334
Signed-off-by: stzuraski898 <steven.zuraski@ibm.com>