osdc/Journaler: validate header on load and save

Previously if the journal header contained invalid
write, expire or trimmed offsets, we would end up
hitting a hard-to-understand assertion much later.

Instead, raise the error right away if the fields
are identifiably bad at load time, and assert that
they're valid before persisting them.

Signed-off-by: John Spray <john.spray@redhat.com>
mds: fix journal reformat failure in standbyreplay

In the 0.82 release, standbyreplay MDS daemons would try
to reformat the jouranl if they saw an older version on
disk, where this should have only been done by the active
MDS for the rank.  Depending on timing, this could cause
fatal corruption of the journal.

This change handles the following cases:
* only do reformat if not in standbyreplay (else raise EAGAIN
to keep trying til an active mds reformats it)
* if journal header goes away while in standbyreplay then raise
EAGAIN (handle rewrite happening in background)
* if journal version is greater than the max supported, suicide

Signed-off-by: John Spray <john.spray@redhat.com>
doc: fix example s/inspect/journal inspect/

Signed-off-by: John Spray <john.spray@redhat.com>