Testing: add --pause-upgrade-retry argument

Similar to the --pause-upgrade-loop argument, which loops indefinitely,
but only applies when a test fails, and retries the failed test after
upgrading (until it succeeds.)

The new argument implies --pause-on-failure.
Add proper, documented, read-only API

This commit does not add a complete API, only the beginnings of one.  It
also doesn't add any uses of the API.  Largely, the added API duplicates
older internal (more or less messy and undocumented) APIs.  The long-term
plan is to remove the duplication by using the new API where possible
(where a read-only view is sufficient) and by restructuring other code.

API design:

- There's a special "session" object of the class api.critic.Critic,
  typically called 'critic'.  It is used throughout the API as a reference
  to all global/per-session stuff, like the database connection.  (In this
  preliminary API version, it contains only a reference to the database
  connection.)  Most API objects have a data attribute 'critic' that
  returns this object, and most functions used to create API objects take
  the object as their first parameter.

- Most API objects are split into two, one "public" that defines the
  interface and one internal that contains the actual implementations.
  The interface definition contains class definitions, method signatures,
  documentation, and typically various assertions checking that the
  provided arguments are sane (which is also a form of documentation.)

- All data attributes on API objects are properties with a getter and no
  setter (thus read-only.)  The getter fetches the value from the
  implementation part of the object, possibly by calling a method that
  calculates the value.

- Data is exposed as data attributes whenever possible, even if the value
  is "complex" and is calculated upon reading.  If reading is expensive,
  the value will typically be calculated on demand and cached.

- Data is exposed via methods only when is makes sense to provide one or
  more arguments to the method.  (It's obviously impossible to provide
  arguments when accessing a data attribute, hence needing a method.)