Falling back to a previous fdbmonitor conf when the new conf is known to be bad

If a user updates fdbmonitor conf in a way that causes the processes to fail to launch, fdbmonitor will keep trying to use the bad configuration forever, until the user manually fixes the conf. This could lead to prolonged unavailability if an error of this form takes down a large portion of the cluster, forcing the user to find a way to revert the conf themselves, or roll it forward onto a fixed conf. Can we explore a mechanism for fdbmonitor to revert back to a known good conf in these situations, to give us more self-healing?

Start by tracing fdbmonitor configuration loading and the process-launch failure path. Define how a known-good configuration is identified and when it should be restored after launch failures; done means a bad update no longer remains in use indefinitely and the fallback behavior is covered by tests.

Written by the indexing model from the issue text.