Add read-only instances to Cartridge replicaset

[yngvar-antonsson]

No we can't restrict Cartridge failover (in Eventual and Stateful mode) to switch on any instance, they're all the same for failover. We could provide argparse option (e.g. CARTRIDGE_READ_ONLY) or smth like this to forbid switching on such instance

[R-omk]

I think that all hosts should start in this mode (ro / voter) and only then the cartridge decides who can become the master (candidate).

It should also work at runtime so that api can force any host to stop being the master or stop being a candidate master.

This feature is needed for the rolling upgrade process to prevent the possibility to elect a node with an old version if a master with a new version has already been elected at least once before.