osdc/Journaler: validate header on load and save

Previously if the journal header contained invalid
write, expire or trimmed offsets, we would end up
hitting a hard-to-understand assertion much later.

Instead, raise the error right away if the fields
are identifiably bad at load time, and assert that
they're valid before persisting them.

Signed-off-by: John Spray <john.spray@redhat.com>
mds: fix journal reformat failure in standbyreplay

In the 0.82 release, standbyreplay MDS daemons would try
to reformat the jouranl if they saw an older version on
disk, where this should have only been done by the active
MDS for the rank.  Depending on timing, this could cause
fatal corruption of the journal.

This change handles the following cases:
* only do reformat if not in standbyreplay (else raise EAGAIN
to keep trying til an active mds reformats it)
* if journal header goes away while in standbyreplay then raise
EAGAIN (handle rewrite happening in background)
* if journal version is greater than the max supported, suicide

Fixes: #8811

Signed-off-by: John Spray <john.spray@redhat.com>
doc: fix example s/inspect/journal inspect/

Signed-off-by: John Spray <john.spray@redhat.com>
osdc: refactor JOURNAL_FORMAT_* constants to enum

...so that the upper limit doesn't have to be updated
by hand.

Signed-off-by: John Spray <john.spray@redhat.com>
Merge pull request #2115 from ceph/wip-8811

Make standby-replay MDSes much more careful about journal formats; both changing them and generally being aware.

Reviewed-by: Greg Farnum <greg@inktank.com>