Disable split-brain checks for partially upgraded clusters

[sergepetrenko]

Split-brain detection first appeared in version 2.10. In order for it to work some changes to the synchro queue were made: notably, replicas started tracking confirmed_lsn (previously it was tracked only on the synchro queue owner).

This means when a cluster is updated from, say, 2.8 to 2.10, all the replicas remember that the last confirmed_lsn is 0. Regardless of the actual value. The first updated node to issue a PROMOTE or DEMOTE will trigger an ER_SPLIT_BRAIN error, since it'll write PROMOTE with a correct confirmed_lsn, not 0.

Let's fix this by disabling split-brain checks in the cluster until the schema version is updated. Once it's updated, it means someone became writeable by issuing a PROMOTE or DEMOTE, writing the correct confirmed_lsn. The schema version update tuple will arrive only after this PROMOTE/DEMOTE, so everyone who has the recent schema version will also have the correct confirmed_lsn.

[sergepetrenko]

In order to reproduce, one has to issue some synchronous requests on 2.8, wait for their confirmation, issue box.snapshot() on the replicas and restart the cluster with newer tarantool version. 2.10 and higher should do.

Once box.ctl.promote() or box.ctl.demote() is issued on the old leader, the replicas will disconnect with the following messages in the log:

2023-08-21 18:44:21.604 [46158] main/110/applier/3301 txn_limbo.c:959 E> RAFT: rejecting RAFT_PROMOTE (31) request from origin_id 1 replica_id 1 term 3. confirmed lsn 0 < request lsn 7 and empty limbo
2023-08-21 18:44:21.604 [46158] main/110/applier/3301 txn_limbo.c:961 E> ER_SPLIT_BRAIN: Split-Brain discovered: got a request mentioning future lsn