binder: Server fails to cancel SecurityPolicy.checkAuthorization() futures before termination

[jdcormie]

What version of gRPC-Java are you using?

master

What is your environment?

Android

Steps to reproduce the bug

1. Create a binder Server using a fake AsyncSecurityPolicy and a custom Executor
2. Create a Channel to that Server and send a call.
3. Observe a check authorization request to your security policy. Return a pending SettableFuture.
4. Call shutdownNow() on the server.
5. Wait for server.awaitTermination() to return.
6. Call shutdown() on the custom Executor.
7. Complete the future from (3)

What did you expect to see?

Call fails with UNAVAILABLE / "Server shutdownNow invoked".

What did you see instead?

RejectedExecutionException

This is a resource leak at least, but not a permanent one, assuming checkAuthorization()s calls eventually return and checkAuthorizationAsync() futures eventually complete. More serious is that the Listeners we install on these futures are set to run on the Server's executor. In the custom Executor case, this is only valid until the Server is terminated (after that the app is allowed to shut it down). And if we're using the grpc-default-executor, it's only valid until BinderServer returns it to the pool in onTerminated().