FE changes for a disable_unsafe_spills query option.

A new disable_unsafe_spills query option allows Impala to internally
disable spilling for potentially disastrous query plans. Impala will
excercise this option if a query has no plan hints, and at least one
table is missing relevant stats.

The explain plan will display a warning that spilling is disabled.

Change-Id: I78c182ff2c7f236be31870123e752370be2ed748
Reviewed-on: http://gerrit.sjc.cloudera.com:8080/4429
Reviewed-by: Alex Behm <alex.behm@cloudera.com>
Tested-by: jenkins