Add a new move FailoverAndReplace

This patch adds a new instance move, FailoverAndReplace, which promotes
the old secondary to primary and then uses a new secondary node.

This is the last move that we can do within the limitations of one node
changed per move.