Commit f5677ab3

 added the _VerifyOob functionality, but there are two
issues with this function:

- a real bug, as objects.Node doesn't have a 'master' attribute
- a design bug, as we need to verify the OOB programs not only on
  current masters, but on all nodes that can become masters via the
  auto-promote functionality; otherwise, an automated cluster operation
  could cause the cluster to become inconsistent (error in verify)

The Node.master bug didn't appear in QA because it is triggered only
with non-master-candidate nodes, and our QA doesn't test this
combination (and neither other node flags combination).

Signed-off-by: Iustin Pop <iustin@google.com>
Reviewed-by: Michael Hanselmann <hansmi@google.com>