Don't lose data if two availability zones go down

If `three_data_hall` is used across three availability zones, we currently guarantee that FDB can survive the failure of one AZ and one machine without any availability loss.

However, I would like to also be able to survive two AZ failure without any data loss (we would lose availability until one AZ comes back).

It is not quite clear to me how we can achieve this, but I think it would involve something like this:

1. During recruitment try to recruit tlogs in all availability zones for `X` seconds (`X` would be a configuration parameter)
2. If recruiting in three AZs is impossible, recruit only in two, but set failure tolerance to a different value.
3. Don't recover at all if only one AZ is available.

The issue names no files, tests, or entry points. Start by tracing three_data_hall recruitment, failure-tolerance configuration, and recovery behavior; done means defining and validating behavior for three, two, and one available availability zones without data loss.

Written by the indexing model from the issue text.