Proposal for pd self-protection

## Feature Request

### Describe your feature request related problem

Currently, the pd is designed as a fast-fail components. However, this design may not be suitable in a large cluster case. For example, in a large cluster, pd leader will be hard to be elected if the hibernate-region is not enabled.
Moreover, we also need to guarantee the qos between pd components and the etcd in order not to let the etcd leader drop.

### Describe the feature you'd like

### Describe alternatives you've considered

### Teachability, Documentation, Adoption, Migration Strategy