expunge sled: planner must not use physical disks being removed

[smklein]

This is probably blocked on #3526, which I believe is adding physical disk policies described in RFD 457. Once we have this, the blueprint planner will need to make sure that:

• it doesn't try to put Crucible zones onto zpools whose disks have a policy other than "in-service" (will be resolved by [reconfigurator] Only place Crucible zones on provisionable zpools #5601)
• it doesn't try to put the dataset for any other kind of Omicron zone (like CockroachDB or Clickhouse or DNS) onto a zpool whose disk has a policy other than "in-service" (will be resolved by [nexus] Remove zones on expunged disks #5599)
• it should identify any zones that already have persistent datasets on such disks and provision replacements instead (partially resolved by [reconfigurator] Only provision to zpools with in-service physical disks #5375 )
• once we add the zone's (transient) root filesystem to the zone's config ([nexus] Make nexus aware of zone filesystems #5050), the planner will also need to identify zones whose root filesystem is on one of these disks and replace it (i.e., write a new config with a root filesystem that's elsewhere) and we'll need to make sure that sled agent does the right thing with that

[smklein]

There are more details with actually plumbing the expungement command through (#5994), but from the planner perspective, this is complete