Make TokenMetadata's ring version increments atomic

The update semantics of the ring version in TokenMetadata are not clear. The instance variable itself is volatile, but it is still incremented by a non-atomic check-and-set, and not all codepaths do that while holding the TokenMetadata write lock. We could make this more intelligible by forcing the external callers to use both the write when invalidating the ring and read lock when reading the current ring version. Most of the readers of the ring version (ex. compaction) don't need it to be fast, but it shouldn't be a problem even if they do. If we do this, we should be able to avoid a situation where concurrent invalidations don't produce two distinct version increments.