Add nil check for serf

The reconcile loop and the startup code which initialises the `c.serf` variable start in parallel so there's a chance for serf to be nil when `MembersFiltered` is called

cluster/cluster.go

@@ -184,6 +184,9 @@ func (c *ClusterImpl) retryJoin(ctx context.Context) {
 }
 
 func (c *ClusterImpl) MembersFiltered(filter map[string]string, status, name string) ([]Member, error) {
+	if c.serf == nil {
+		return nil, fmt.Errorf("serf not initialized")
+	}
 	return FilterMembers(toClusterMembers(c.serf.Members()), filter, status, name)
 }