Support for expungement leading to faulted disks

Nexus currently only faults disks in a few scenarios, none of which respond to when a physical disk is expunged. This issue tracks implementing the following:

• a disk could be faulted while attached to an instance but the current DiskState::Faulted enum variant does not have an attached instance id. Adding this requires three API bumps and investigating the existing logic in Nexus that checks functions like DiskState::is_attached

• a background task should scan for disks backed by local storage, and set those disks to faulted if the physical disk that the local storage dataset is on was expunged.

• similarly, a task should scan for disks backed by crucible and check if all the downstairs in any region set for a volume were expunged. if this is true then that disk should be set to faulted as well

• deciding what to do with instances whose disks are faulted: discussions about this landed on either requesting that the instance stops immediately, or sending a hot-unplug event, depending probably on some user configurable policy

Start with DiskState::Faulted and the existing DiskState::is_attached checks, then trace the API bumps and background task entry points described in the issue. Review how local-storage datasets and Crucible downstairs are represented when physical disks are expunged. Done means both storage paths fault affected disks and the instance behavior policy is resolved and implemented.