More tweaks to the shared asset system

[kring]

This is a PR into #964.

• Moved SharedAsset and SharedAssetDepot into CesiumAsync.
• Renamed SharedAssetSystem to GltfSharedAssetSystem and moved it to CesiumGltfReader.
• Guard against the size of an asset changing in between when it's added to the deletion list and when it's removed, which would disrupt the depot size tracking.
• Remove SharedAsset::isShareable. Even non-depot assets can be shared, so this method was misleading.
• Lots of small tweaks to the shared asset system.
• Make SharedAsset constructor and destructor protected, so instances of
  this type can't be created directly.
• Change the staleAssetSizeLimit to 16 MiB.
• Add some defensive assertions.
• Fix use-after-free when removing deletion candidates.

Still to do:

• Construct SharedAssetDepot with a Factory, instead of passing one in on getOrFetch call.
• Rename ImageCesium to ImageAsset.
• Put asset state documentation from Fix asset lifetime, avoid circular reference counting. #964 somewhere in the code.
• Convert non-Doxygen comments at the top of SharedAsset to Doxygen.
• Kind of vague, but I'm not happy with GltfSharedAssetSystem just yet.