tcp-clients could still be exceeded (v2)

tcp-clients could still be exceeded (v2)

the TCP client quota could still be ineffective under some
circumstances.  this change:

- improves quota accounting to ensure that TCP clients are
  properly limited, while still guaranteeing that at least one client
  is always available to serve TCP connections on each interface.
- uses more descriptive names and removes one (ntcptarget) that
  was no longer needed
- adds comments

(cherry picked from commit a43fe7cd3f051f12bb544b6fa364135b1719c587)
(cherry picked from commit 7278b66cdf2e9e3ec79f0c7586091c2fc96317d0)