keyspace: validate etcd endpoints before adding meta-service groups

## Enhancement Task

When a meta-service group is added through runtime configuration, PD currently
accepts its configured etcd endpoints without checking whether each target
server is reachable and healthy. A later status update could therefore enable
a group with an unusable endpoint.

Before persisting a newly added meta-service group, validate every
comma-separated etcd endpoint. Reject the addition when any endpoint fails the
etcd health check, so only a group with reachable endpoints can subsequently
be enabled through the existing status API. New groups remain disabled by
default; this task does not add configuration-based enablement.

Implementation covers the generic `/config` path, v2 meta-service-group API,
and pd-ctl. Tests verify successful checks, rejection without persistence, and
API/CLI behavior.

Start with the generic /config path, the v2 meta-service-group API, and pd-ctl, then locate the existing etcd health-check logic. Done means every comma-separated endpoint is checked before persistence, unhealthy additions are rejected without saving, and the successful, API, and CLI behaviors are covered by tests.

Written by the indexing model from the issue text.