Fix tracking of planes flying a sortie

Planes normally sit in their base (sector or carrier), where they can
be spied, damaged, captured, loaded, unloaded, upgraded and so forth.
All this must not be possible while they fly.  There are two kinds of
flying planes: satellites in orbit, and planes flying a sortie.

Satellites in orbit have always been marked with flag PLN_LAUNCHED.
Works.  What didn't work was tracking planes flying a sortie.

If you look at one sortie in isolation, up to three groups of planes
can be flying at any point of time: the primary group, which carries
out the sortie's mission (bomb, transport, ...), their escorts, and a
group of hostile planes flying interception or air defense.

The old code attempted to track these planes by passing those groups
to the places that need to know whether a plane is flying.  This was
complex and incomplete, and broke down completely for the pin-bombing
command.

It was complex, because the plane code needs to keep track of all the
call chains that can lead to a place that needs to know whether a
plane flies, and pass the groups down the call chains.  This leads to
a rather ugly passing of plane groups all over the place.

It was incomplete, because it generally failed to pass the escorts.

And the whole scheme broke down for the pin-bombing command.  That's
because pin-bombing asks the player for targets while his planes are
loitering above the target sector.  This yields the processor and lets
other code run.  Which does not get the flying planes passed.

The new code marks planes and SAMs (but not other missiles) flying a
sortie with flag PLN_LAUNCHED (the previous commit laid the groundwork
for that), and does away with passing around groups of flying planes.

This fixes the following bugs:

* Many commands could interact with foreign planes flying for a
  pin-bombing command as if they were sitting in their base.  This
  includes spying, damaging, capturing, loading, or upgrading them,
  and even getting intercepted by them.  Any changes to those planes
  were wiped out when they landed.  Abusable.

* The bomb command could bomb its own escorts, directly (pin-bomb
  planes) or through collateral damage, strategic sector damage,
  collapsing bridges or nuke damage.  The damage to the escorts was
  wiped out when they landed.

* If you asked for a plane to fly both in the primary group and the
  escort group, you got charged fuel for two sorties instead of one.

* pln_put1() and pln_put() now recognize planes that didn't take off,
  and refrain from making them land.  Intercept (since commit
  c64e2149) and air defense can do that.  Making them land had no
  ill-effects, but it was still wrong.

There's one new problem: if PLN_LAUNCHED doesn't get reset properly,
due to game crash during flight or some other bug, the plane gets
stuck in the air.  Catch and fix that on game start in ef_verify().

src/lib/commands/para.c

@@ -105,8 +105,8 @@ para(void)
     }
     mission_flags = pln_arm(&esc_list, 2 * ap_to_target, 'a',
 			    &ichr[I_MILIT], P_ESC | P_F, mission_flags);
-    ac_encounter(&bomb_list, &esc_list, ax, ay, flightpath, mission_flags,
-		 0, 0, 0);
+    ac_encounter(&bomb_list, &esc_list, ax, ay,
+		 flightpath, mission_flags, 0);
     if (QEMPTY(&bomb_list)) {
 	pr("No planes got through fighter defenses\n");
     } else {