pageserver: implement emergency mode for operating without control plane

[jcsp]

Problem

Pageservers with control_plane_api configured require a control plane to start up: in an incident this might be a problem.

Summary of changes

Note to reviewers: most of the code churn in mgr.rs is the refactor commit that enables the later emergency mode commit: you may want to review commits separately.

• Add control_plane_emergency_mode configuration property
• Refactor init_tenant_mgr to separate loading configurations from the main loop where we construct Tenant, so that the generations fetch can peek at the configs in emergency mode.
• During startup, in emergency mode, attach any tenants that were attached on their last run, using the same generation number.

Closes: #5381
Closes: #5492

[github-actions]

2256 tests run: 2140 passed, 0 failed, 116 skipped (full report)

---

Code coverage (full report)

• functions: 52.6% (8144 of 15479 functions)
• lines: 81.2% (47591 of 58583 lines)

---

_{The comment gets automatically updated with the latest test results
a548284 at 2023-10-06T11:36:29.639Z :recycle:}

[koivunej]

Unable to catch anything higher level than the span usage, timeouting tests with the many layers being generated (I guess mock_s3 can get slow -- it's the python impl).

[koivunej]

I think I now understood it. I don't necessarily like the ordering or structuring but unable to suggest a better one. This was split from some other PR so let's hope it'll reorder :)