If the group's owner is spamming, unsubscribe.

This depends on the (unspecified) order in which new secrets are stored.
For example, if the secrets for periods 0 - 2 are loaded in period 3,
the secrets for periods 3 and 4 will be stored; the secrets for periods
0 and 1 may expire separately if the secret for period 3 is stored
before the secret for period 4, or together if the secret for period 4
is stored before the secret for period 3.

Find the newest dead secret for each endpoint, erase any others and
derive from the newest.

This bug was causing crashes at shutdown when the connection recogniser
tried to derive tags from secrets that had been erased by the key
manager - the derived tags were not present in the recogniser's maps.

Some packet types weren't being generated or handled, connections
weren't properly disposed of when exceptions occurred.

Some devices don't support IPv6, so we'll need to bind separate IPv4 and
IPv6 sockets and advertise both addresses.