Joystick: account for pilot input failsafes

Extension of #713, to avoid accidentally causing a failsafe while also avoiding needless resource wastage:

> An ideal solution would account for whether there is a pilot input failsafe configured, and if so send repeated inputs only as often as necessitated by the timeout parameter (to minimise resource wastage). That said, I'm not sure whether non-ArduSub vehicles actually have such a failsafe - could be good to check that, and/or offer the repeated message frequency as a user-configurable parameter.

ArduSub has [`FS_PILOT_INPUT`](https://docs.bluerobotics.com/ardusub-zola/software/autopilot/ArduSub-4.1/developers/parameters/#fs-pilot-input-pilot-input-failsafe-action), with times managed by [`FS_PILOT_TIMEOUT`](https://docs.bluerobotics.com/ardusub-zola/software/autopilot/ArduSub-4.1/developers/parameters/#fs-pilot-timeout-timeout-for-activation-of-pilot-input-failsafe).

Rover has [`RC_FS_TIMEOUT`](https://ardupilot.org/rover/docs/parameters.html#rc-fs-timeout-rc-failsafe-timeout), although we should check whether this applies to `MANUAL_CONTROL` (and `RC_CHANNELS_OVERRIDE`, for future reference), or if it only applies to real RC input.

Haven't checked other vehicle firmwares, and it's probably worth supporting a manual override in Cockpit since we can't guarantee all vehicles will have such a parameter for a timeout.

---

**NOTE:** autopilot handling of no pilot input is generally separate to how it handles completely losing connection to the control station software (e.g. triggered via a heartbeat/gcs failsafe, like [`GCS_FS_ENABLE`](https://docs.bluerobotics.com/ardusub-zola/software/autopilot/ArduSub-4.1/developers/parameters/#fs-gcs-enable-ground-station-failsafe-enable)).

Start with the joystick repeated-input work from issue #713, then investigate how MANUAL_CONTROL relates to FS_PILOT_TIMEOUT, RC_FS_TIMEOUT, and other vehicle failsafe parameters. Check the relevant ArduPilot vehicle documentation and determine whether a manual frequency override is needed; done means inputs are sent often enough to avoid failsafe activation without needless resource use.

Written by the indexing model from the issue text.