For every node we check that we can host all the instances it's currently
secondary for belonging to the same primary. This ensures that if a node fails
all its instances can fit on their secondary node. The code only works when
failover is forced to go to the secondary node, and cannot go to an arbitrary
node in the cluster, which is the case in Ganeti 1.2.

Reviewed-by: iustinp