(CDAP-749) Fix program infinite restart

This PR has two changes:

   1. Refactor ProgramController to make the contract clear on when and how listener events are fired
   1. When a program fails, it shouldn't get restarted. This is because all program runner should be handling user and system with proper retry. If a program ever error out, it's an unrecoverable error that shouldn't get retry.
Same reason as above. Any delay will lower the chance.