Fix a work-counting bug introduced by the workqueue merge

David Goulet finds that when he runs a busy relay for a while with the
latest version of the git code, the number of onionskins handled
slowly dwindles to zero, with total_pending_tasks wedged at its
maximum value.

I conjecture this is because the total_pending_tasks variable isn't
decremented when we successfully cancel a job.  Fixed that.

Fixes bug 14741; bugfix not on any released version of tor.

src/or/cpuworker.c

@@ -298,6 +298,7 @@ cpuworker_onion_handshake_replyfn(void *work_)
   cpuworker_reply_t rpl;
   or_circuit_t *circ = NULL;
 
+  tor_assert(total_pending_tasks > 0);
   --total_pending_tasks;
 
   /* Could avoid this, but doesn't matter. */
@@ -553,6 +554,8 @@ cpuworker_cancel_circ_handshake(or_circuit_t *circ)
     /* It successfully cancelled. */
     memwipe(job, 0xe0, sizeof(*job));
     tor_free(job);
+    tor_assert(total_pending_tasks > 0);
+    --total_pending_tasks;
   }
 
   circ->workqueue_entry = NULL;