Call destroyInstance after workers have exited

Router and filter instances cannot be destroyed before all worker
threads have exited. Otherwise there is a risk that data gets deleted
while someone might still be accessing it. Further, since all router
and filter instances are created by the main-thread it is better that
they are deleted by that thread as well (and not by whichever thread
happens to execute service_shutdown()). That will reduce the risk that
some unknown assumptions are violated.

server/core/service.c

@@ -1892,6 +1892,18 @@ void service_shutdown()
     while (svc != NULL)
     {
         svc->svc_do_shutdown = true;
+        svc = svc->next;
+    }
+    spinlock_release(&service_spin);
+}
+
+void service_destroy_instances(void)
+{
+    spinlock_acquire(&service_spin);
+    SERVICE* svc = allServices;
+    while (svc != NULL)
+    {
+        ss_dassert(svc->svc_do_shutdown);
         /* Call destroyInstance hook for routers */
         if (svc->router->destroyInstance && svc->router_instance)
         {