Prevent old servers from joining when certain new features are established

Some features like having intentions as config-entries rely on all servers in a DC supporting the feature. We track that by using feature flags which get stored as Serf tags.

Once we detect that all servers are on a version that supports the feature, we enable it. However, issues will arise if a server on an older version of Consul joins after the feature is enabled. This is because the old server won't understand how to store/query that data.

Since the leader is aware of what is enabled in the datacenter, it could check the Serf tags of incoming servers here:
https://github.com/hashicorp/consul/blob/master/agent/consul/leader.go#L1368

If the tags do not line up with the ones required, we avoid adding the server to raft and potentially give it a failing check with an appropriate note.

Start at agent/consul/leader.go around line 1368 and trace how incoming servers are checked before being added to raft. Review the existing Serf tags and feature-flag state described in the issue. Done means an incompatible older server is prevented from joining and may receive a failing check with an appropriate note.

Written by the indexing model from the issue text.