system deployments: fix scheduler write skew from stale snapshot

[tgross]

During a system deployment, if a client update marking an allocation healthy happens after a scheduler worker has taken a snapshot, the plan will overwrite the HealthyAllocs count on the deployment. The client never writes another health update, so the deployment gets stuck even though all allocations are marked healthy.

Likewise, if a scheduler worker takes a snapshot and the deployment is promoted before the plan is submitted, the number of canaries will be mutated and the promotion flag potentially removed.

Break the DeploymentState into "client owned" vs "server owned" fields, and have the update that comes from upserting a plan treat the client owned fields as authoritative for that data. Enforce in the FSM that flipping Promoted to true for the deployment state is a one-way operation.

Fixes: #27382
Ref: https://hashicorp.atlassian.net/browse/NMD-1197

Contributor Checklist

• Changelog Entry If this PR changes user-facing behavior, please generate and add a
  changelog entry using the make cl command.
• Testing Please add tests to cover any new functionality or to demonstrate bug fixes and
  ensure regressions will be caught.
• Documentation If the change impacts user-facing functionality such as the CLI, API, UI,
  and job configuration, please update the Nomad product documentation, which is stored in the
  web-unified-docs repo. Refer to the web-unified-docs contributor guide for docs guidelines.
  Please also consider whether the change requires notes within the upgrade
  guide. If you would like help with the docs, tag the nomad-docs team in this PR.

Reviewer Checklist

• Backport Labels Please add the correct backport labels as described by the internal
  backporting document.
• Commit Type Ensure the correct merge method is selected which should be "squash and merge"
  in the majority of situations. The main exceptions are long-lived feature branches or merges where
  history should be preserved.
• Enterprise PRs If this is an enterprise only PR, please add any required changelog entry
  within the public repository.

• If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.