EKF: bug in handling of loss of primary compass (does not fall back to secondary compass)

If primary compass is lost then the EKF does not fall back to a backup compass. We need to work out exactly what behaviour we want. Key situations are:
- primary compass stops giving data
- user set COMPASS_USE=0 to disable primary

Before we can fix this we need to have a way to kill compasses in SITL, so we can test the behaviour properly

Start by reviewing the EKF compass-selection path and SITL compass controls; the issue names no files or tests. Define expected behavior for a stopped primary compass versus COMPASS_USE=0, then verify in SITL that the secondary compass is selected in each applicable case.

Written by the indexing model from the issue text.