Limit max duration of Module shutdown

When shutting down Openfire, XMPPServer shuts down every module. It makes sense to time-limit every module shutdown, killing it hard(er) when that duration is exceeded.