Low: tools: Do not allow certain operations on clone instances.

For anonymous clones, users do not see the instance numbers anywhere so
they are highly unlikely to specify them on the command line without
lots of trial and error. So disable that.

For unique clones, you cannot restart an instance by ban because
something like "rsc=rsc:0" is not allowed in the CIB schema due to using
IDREF for it. Thus, schema updates will fail. So you'd have to restart
by restarting all instances. In that case, we might as well just treat
unique clones like anonymous clones and let the user only give the name
of the clone resource and not an instance.