Blueprint planner: gate zone adds and updates on boot disk host phase 2 being at a known version

Followup from https://github.com/oxidecomputer/omicron/issues/8726.

For the initial implementation we're just checking that all zone image sources are at known versions. In principle, we should also check that the boot disk's host phase 2 image is a known version. (We don't care as much about the non-boot disk.)

The problem with doing this check today is that:

• The blueprint doesn't currently cache information about which disk is the boot disk.
• Inventory does have this information, but if a sled isn't in inventory (due to, say, a transient network error), we won't have this information.

For now, we assume that if all zone image sources are at known versions, the host phase 2 image is also most likely at a known version. But this is a somewhat fragile assumption, so we should fix it properly at some point (maybe by caching the last known boot disk for a sled in the blueprint).

Note that the host phase 1 and phase 2 images are already coupled with each other, so checking that host phase 2 is known is equivalent to checking that both host OS phases are known.

Start with the follow-up issue #8726 and the blueprint planner's existing checks that zone image sources have known versions. Trace how blueprint and inventory data represent a sled's boot disk, then define a way to retain or obtain that information when inventory is unavailable; done means boot disk host phase 2 is checked without relying on the fragile zone-source assumption.