Fixes#7829.
The online update check could crash on shutdown because the thread
destructor would run from the wrong thread. This caused the main form
destruction, which happens if the user chooses to install the update,
to be triggered from the worker thread, leading to much pain.
Fixes#4757.
Fixes#6928.
Three separate ways shutdown is more robust:
1. Destroy main form before web server -- this ensures that all main
form routines have deregistered app sources from web server.
2. In some situations, `FormClose` can be skipped by shutdown routines,
for example, if you call `Application.Terminate`. This change ensures
that we get a second chance to cleanup in the form destructor with
`DoCloseCleanup`.
3. In the Online Update Check, instead of `Application.Terminate`, we
now use `Application.MainForm.Close`, which is much more polite, as
it ensures that changed files are saved, etc, and does proper
cleanup. This particular change may make the other two somewhat
irrelevant but they are still sensible as they will cover us for
other potential form destruction sequences.
