`blippy` should check that a decommissioned sled has no in-service zones

I was manually tweaking a Blueprint in some unit tests, and was mildly surprised that Blueprint::all_omicron_zones(BlueprintZoneFilter::is_in_service) returned zones on a sled I had marked as in SledState::Decommissioned. When the planner decommissions a sled, it also expunges everything on that sled, so I think the actual bug here is in my test (if I'm going to decommission a sled, I should also expunge all its zones). blippy could (and should) check this invariant.

Start by locating the blippy checks around Blueprint::all_omicron_zones, BlueprintZoneFilter::is_in_service, and SledState::Decommissioned. Review how the planner handles decommissioned sleds, then add the invariant check so a decommissioned sled cannot retain in-service zones and verify it with the relevant blippy tests.