We should look into creating a policy where a session can only be checked out from the WiredTigerSessionCache while we are not shutting down, and where we can only shut down when there are no outstanding sessions that have not been checked back into the session cache. This should simplify a lot of our behavior around shutdown, and prevent bugs caused by attempting to access the storage engine after it has been shut down (for example, if a recovery unit destructor tries to release its session back into the cache after the storage engine has been shut down).