Feature: controller: allow configurable reaction to local node fencing

e4fc243 fixed a bug so that when the local node is notified of its own fencing,
it correctly panics.

However, some users may have been relying on the previous behavior. In
particular, some users may configure fabric fencing because they don't
want the node ever intentionally hard-powered off.

This creates a new cluster property, fence-reaction, that controls the
behavior ("stop" for the original behavior, "panic" for the more correct
behavior). For now, it defaults to "stop", to preserve the current behavior.
At the next minor bump (2.1.0), we can flip the default.