Clean up the area of pthread key destruction.

The previous commentary (based on code inspection) was wrong. We do correctly implement the POSIX semantics of only calling pthread key destructor functions for non-null values. This change updates the documentation to be correct, adds the missing unit tests that prove that the implementation is correct, and changes the implementation to make it more obviously correct (and so we can add an explicit code comment pointing out the relevant null check).

Change-Id: I04511021233da8aac80c010eb111ffe615171611
diff --git a/libc/include/pthread.h b/libc/include/pthread.h
index f3b7068..5a3376a 100644
--- a/libc/include/pthread.h
+++ b/libc/include/pthread.h
@@ -187,8 +187,7 @@
  * different language, you should consider similar implementation choices and
  * avoid a direct one-to-one mapping from thread locals to pthread keys.
  *
- * On Android, the destructor function is called even for null values,
- * even though POSIX specifies that it is only called for non-null values.
+ * The destructor function is only called for non-null values.
  *
  * Returns 0 on success and returns an error number on failure.
  */