Feature: scheduler: add shutdown lock cluster options

This commit adds shutdown-lock and shutdown-lock-limit options (just the
options, not the feature itself).

shutdown-lock defaults to false, which preserves current behavior. The intended
purpose of setting it to true is to *prevent* recovery of a node's resources
elsewhere when the node is cleanly shut down, until the node rejoins. If
shutdown-lock-limit is set to a nonzero time duration, the cluster will
be allowed to recover the resources if the node has not rejoined within this
time.

The use case is when rebooting a node (such as for software updates) is done by
cluster-unaware system administrators during scheduled maintenance windows,
resources prefer specific nodes, and resource recovery time is high.