Fix: controller: don't fence leaving nodes for node-pending-timeout

The node-pending-timeout is intended to apply only when the node is joining the
cluster, not when it is leaving. Avoid enforcing it for leaving nodes by
setting their in_ccm to 1 (rather than a timestamp) when they leave CPG.
This will cause the scheduler to ignore node-pending-timeout (since it appears
the same as a legacy node_state entry).

This does mean that if someone stops Pacemaker (but not the cluster layer) on a
node, then starts it again (without restarting the cluster layer), that
node-pending-timeout will not apply in that case, either. But since that would
likely be a system administrator doing manual troubleshooting, that's
acceptable.

Fixes T695