Handle down nodes deterministically

For a cluster of > 3 nodes, if a node was administratively marked down, it was effectively impossible to commit a `cluster leave` action because the `random` library was used to determine how to cope with the down node, but the claimant's seed value wasn't used inside `handle_down_nodes/2`.

Thanks to @nickelization for the assistance in chasing this down.

One perhaps irrelevant observation: we're now using the same seed twice for `random:uniform_s/2` invocations (also used in `riak_core_gossip:attempt_simple_transfer/7`).

@jtuple, per our discussion last night, here's the fix. Interested in opinions on what type of testing we should add for this.