Log: executor: improve messages after fencing connection loss

Previously, both stonith_connection_destroy_cb() and
stonith_connection_failed() would log an error for the same fencer connection
loss. Now, log it once, as a warning, since the executor can reconnect (if
there aren't any pending operations, there's no immediate problem, and if there
are, those will be logged as failed separately).

Also, stonith_connection_failed() previously would concatenate a fence device's
active, recurring, and pending operations into one list and finalize each.
If the same operation was both active and recurring, it would get finalized
twice, which wouldn't cause problems but would show redundant logs and an
incorrect count.

To fix that, stonith_connection_failed() has been refactored to finalize
recurring actions first, which will make it no longer considered active if it
was. The function previously removed ops from rsc->recurring_ops, which
obscured the fact that stonith_action_complete() -> cmd_finalize() would not
free it but would add it back to pending ops. Now, don't remove it, to make it
more obvious that recurring ops remain active after a connection loss.