Fix the ReplacePrimary instance move
During a replace-primary instance move, on the real cluster the instance is temporarily started on the secondary, and as such we must check that the secondary node can hold it for this duration. Currently the code does not, and depending on cluster scoring it will put instances on such 'bad' secondaries (usually without enough memory). This patch fixes this by adding/removing the instance as a primary on the secondary node; and then using the result node as the new secondary. (Since we're in a monad, we could have just tried the allocation and dropped the result, but this is more clear).