Feature: scheduler: add shutdown lock cluster options
    
    This commit adds shutdown-lock and shutdown-lock-limit options (just the
    options, not the feature itself).
    
    shutdown-lock defaults to false, which preserves current behavior. The intended
    purpose of setting it to true is to *prevent* recovery of a node's resources
    elsewhere when the node is cleanly shut down, until the node rejoins. If
    shutdown-lock-limit is set to a nonzero time duration, the cluster will
    be allowed to recover the resources if the node has not rejoined within this
    time.
    
    The use case is when rebooting a node (such as for software updates) is done by
    cluster-unaware system administrators during scheduled maintenance windows,
    resources prefer specific nodes, and resource recovery time is high.