Fix cv_waiters wraparound bug

[markj]

Summary

This is another attempt to fix the issue described in r282971, which was
reverted in r283250. Rather than eliminating cv_waiters entirely, cap
its value at INT_MAX and modify cv_signal() to handle that case
appropriately. In particular, this lets us avoid looking up the
sleepqueue on every call to cv_signal().

[markj]

Don't assert cv_waiters == 0 in cv_destroy().

It may be non-zero even with zero sleepers, since threads don't
decrement it when they wake up.