Added basic doc for HA

I created a doc for High Availability based on code analysis and interviewing people from the team that where involved in the design and development of this.
there is no excuse whatsoever for much of this. provisioner/firewaller, fine, we're dealing with eventually-consistent external reality; go ahead and run a single one. All the rest are meant to run everywhere -- *especially* the resumer, for which there is no excuse whatsoever -- someone did extra work to prevent it running where it should -- but part of the HA work was meant to be making sure the cleanup/minunits/charmrev stuff was implemented properly.

So, for your current perspective: certainly document how it *is*, but please also document how it should be. Really, even the single provisioner/firewaller are problems; but those ones are the tech debt I agreed to take on, and all the others are sneakily-inserted balloon payments that will screw us just when we think we've got time to fix the provisioner and firewaller.

sorry, I'm a bit grumpy today.