Prevent flow livelocks and deadlocks when multiple nodes are drained in quick succession

Experiments have shown (see https://r3dlg.slack.com/archives/C2EMVPJT0/p1563188692130600) that if multiple nodes are placed into flow drain mode in quick succession, this can lead to a situation where flows no longer progress and nodes never drain fully.

We need to identify the causes of this, and either address it or provide the best guidance we can regarding how it can be avoided/recovered from.