mon/Paxos: commit only after entire quorum acks (DNM until more testing)

If a subset of the quorum accepts the proposal and we commit, we will start 
sharing the new state.  However, the mon that didn't yet reply with the 
accept may still be sharing the old and stale value.

The simplest way to prevent this is not to commit until the entire quorum 
replies.  In the general case, there are no failures and this is just fine. 
In the failure case, we will call a new election and have a smaller quorum of
(live) nodes and will recommit the same value.

A more performant solution would be to have a separate message invalidate the
old state and commit once we have all invalidations and a majority of 
accepts.  This will lower latency a bit in the non-failure case, but not 
change the failure case significantly.  Later!

Fixes: #7736 Signed-off-by: Sage Weil <sage@inktank.com>