impl(pubsub): subscriber shutdown (#5251)

Part of the work for #5024

Support a shutdown, signaled by the application (via a `ShutdownToken`,
or by `drop`ping the stream), and after a permanent error.

None of this is public. The next PR will make it public and add the
proper documentation for the `shutdown_token()` accessor.

I couldn't really break this down without regressing existing behavior.
And in the middle of the release, that seemed like a bad idea.

Author: dbolduc