Require stable cluster health before advancing a rolling restart

[tomach]

Summary of changes

The rolling-restart health gate (is_cluster_healthy) decided it was safe to kill the next node from a single snapshot of sys.nodes and sys.health. Node membership becomes visible before the master finishes recomputing cluster health, so there is a short window where the count is back and sys.health still reports a stale GREEN.

Now it requires the same healthy reading to hold across N consecutive checks before returning healthy. Configurable via HEALTH_CHECK_STABILITY_CHECKS (default 3) and HEALTH_CHECK_STABILITY_DELAY (default 2s)

Checklist

• Link to issue this PR refers to: https://github.com/crate/support/issues/916
• Relevant changes are reflected in CHANGES.rst
• Added or changed code is covered by tests
• Documentation has been updated if necessary
• Changed code does not contain any breaking changes (or this is a major version change)

[plaharanne]

I've added one note about a comment but except that, it looks good to me.