Guard operations that yield downtime with an `downtimeAllowed` field

[ewoutp]

Add a specification field downtimeAllowed that must be true for automatic operations that result in downtime. If such an operation is required but this field is not set to true, an event is added to record the need for the operation, but the operation itself is postponed.