mon/OSDMonitor: require force argument to split a cache pool

There are several perils when splitting a cache pool:

 - split invalidstes pg stats, which disables the agent
- a scrub must be manually triggered post-split to rebuild stats
- the pool may fill the OSDs during that period.
- or, the pool may end up beyond the 'full' mark and once scrub does
  complete and the agent activate we may block IO for a long time while
  we catch up with flush/evict

Make it a bit harder for users to shoot themselves in the foot.

Fixes: #8043 Signed-off-by: Sage Weil <sage@inktank.com>