During a replace-primary instance move, on the real cluster the instance
is temporarily started on the secondary, and as such we must check that
the secondary node can hold it for this duration. Currently the code
does not, and depending on cluster scoring it will put instances on such
'bad' secondaries (usually without enough memory).

This patch fixes this by adding/removing the instance as a primary on
the secondary node; and then using the result node as the new secondary.
(Since we're in a monad, we could have just tried the allocation and
dropped the result, but this is more clear).