First pass at graceful shutdown handlers

[venkat1109]

What changed?
This patch implements mechanism to gracefully drain traffic during deployments to avoid availability drops. The mechanism varies somewhat based on the role.

The shutdown protocol on some host H looks like the following:

History

1. Remove H from the membership ring. This will make other members believe that H is unhealthy
2. Wait for other members to discover that H is unhealthy
3. Stop acquiring new shards (periodically or based on other membership changes) on H
4. Wait for shard ownership to transfer (and inflight requests to drain) while still accepting new requests on H
5. Reject all requests arriving at rpc handler on H to avoid taking on more work
6. Wait for grace period
7. Force stop the whole world and exit

Frontend

1. Fail rpc health check, this will cause client side load balancer to stop forwarding requests to this node
2. Wait for failure detection time, typically this will be around 5s or less
3. Stop taking new rpc requests by returning InternalServiceError
4. Wait for a second
5. Stop the world and exit

Matching

1. Remove H from the membership ring. This will make other members believe that H is unhealthy
2. Wait for others to discover that H is unhealthy and traffic to drain
3. Stop the world and exit

Why?
Grace shutdown mechanism is needed to reduce availability dips during deployments

How did you test it?
Tested locally. Also tested on a staging environment.

Potential risks
Graceful shutdown fails to work and there continues to be availability dips during deployment.
A bug in the code causes process to crash during shutdown.

First pass at fixing #1454

[coveralls]

Coverage decreased (-0.5%) to 67.032% when pulling 1603000 on venkat1109:v_graceful_shutdown into a5111a6 on uber:master.