Allocation of a bucket can trigger a cross-domain free in the bucket
zone, e.g., if the per-CPU alloc bucket is empty, we free it and get
migrated to a remote domain. I believe this can lead to deadlocks,
since a bucket zone may allocate buckets from itself, or a pair of
bucket zones could be allocating from each other.

Fix the problem by dropping the cross-domain lock before allocating a
new bucket and handling refill races. I added a list of empty buckets
to ensure that we can make forward progress.