Query.Filter: Fix `not` filters for `gnt-job list --filter`

Fixes #954.

When using a `not` filter in `gnt-job --filter`, incorrect results
were returned. Example:

   $ gnt-job list
   4513 canceled TEST_DELAY(1.0)
   4514 canceled TEST_DELAY(1.0)
   4515 success  TEST_DELAY(1.0)

   $ gnt-job list --filter '(status == "success")'
   4515 success  TEST_DELAY(1.0)

   $ gnt-job list --filter 'not (status == "success")'
   [no output, should be 2 lines]

The reason for this was the following sequence in
`Ganeti.Query.Query.queryJobs`:

    rjids <- all relevant job IDs
    -- runs first pass of the filter, without a runtime context; this
    -- will limit the jobs that we'll load from disk
    jids <- toError $
      filterM (\jid -> evaluateQueryFilter cfg Nothing jid cfilter) rjids
    -- Second pass of the filter, with runtime context (job).
    fdata :: [[ResultEntry]] <- foldM
      (get real data using: evaluateQueryFilter cfg (Just job) jid cfilter)
      []
      jids

`jids` should be a superset of the rows of `fdata`.
The idea is that `jids` is a conservative list of candidate jobs
that we certainly have to look at.

However, the `wrapGetter` function in `evaluateQueryFilter :: ErrorResult Bool`
unconditionally returned `True` in the first pass above, ignoring
that this `True` answer might later be negated by a `not`,
thus making `jids == []` and `fdata == []`.

This patch solves the problem by separating the answers to "does the filter"
match" and "can we not answer the query because of missing runtime data",
which were mixed up before in a single Bool; this now becomes Maybe Bool
(with `Nothing` for "can not answer").

Signed-off-by: Niklas Hambuechen <niklash@google.com>