Prevent nodes added during a rolled back reconfiguration from disrupting the service

[heidihoward]

It is my understanding that newly added nodes begin ticking (see: https://github.com/microsoft/CCF/blob/src/consensus/aft/raft.h#L1305) and thus can become a candidate when their reconfiguration txn becomes committable (followed by a signature txn). If the reconfiguration is then rolled back, then the newly added nodes will timeout, repeatedly trying to become a leader, and thus disrupt the active configuration.

One possible solution is to require newly added nodes (nodes who have not yet seen the reconfiguration txn which added them be committed) to check the status of the reconfiguration txn before starting an election. If the reconfiguration txn is invalid, then they can safety shut down.

This is low priority as it is hypothetical and could only impact liveness if a reconfiguration is unsuccessful. This could also be fixed by PreVote (#2577).

[jumaffre]

I believe this is effectively the same issue as described in #3250.