scrubber: more robust metadata consistency check

[jcsp]

The scrubber's scan_metadata command will flag some inconsistencies, but it's not quite robust enough to trust at scale:

• It needs to handle objects being deleted while it scans, by re-reading the index after scan and checking that any objects that vanished have also vanished from the index.
• It needs a way of reporting results that we can alert on at scale. Perhaps this is a log, perhaps it's a write to a database, or a write to a scrub report in S3.

Basically the code in branch_cleanup_and_check_errors is somewhat old and crufty and needs a fresh set of eyes to make sure we are robustly checking a well understood set of things, before we can use it at scale to increase confidence that our metadata's integrity is okay.

Tasks

Beta Give feedback

1. Implement the check, and tests that it catches corruptions
2. Wire the check into a command suitable for running along with physical GC (a la https://github.com/neondatabase/cloud/issues/14024)