vfs: redesign MemFS strict mode

[RaduBerinde]

Currently we use MemFS in "strict" mode to test crash recovery in
the following way:

• at the desired crash point we call SetIgnoreSyncs(true)
• after we close the database, we call ResetToSyncedState() and
  SetIgnoreSyncs(false) and proceed using the same filesystem.

This model is a bit fragile in the sense that both the previous
operation that we're simulating a crash of and the new operation use
the same filesystem. For example, a background operation that is
finishing up some cleanup could in principle interfere with the new
process.

We switch to a "crash clone" model, where we instead extract a
crash-consistent copy of the filesystem; further testing can proceed
on this independent copy. This allows for more usage patterns - e.g.
we can take multiple crash clones at various points and check them all
afterwards.

We also add functionality to randomly retain part of the unsynced
data (which is closer to what would happen in a real crash).

[cockroach-teamcity]

This change is 

[jbowens]

Reviewed 16 of 16 files at r1, all commit messages.
Reviewable status: all files reviewed, 1 unresolved discussion (waiting on @RaduBerinde)

---

error_test.go line 436 at r1 (raw file):

		inj := errorfs.InjectorFunc(func(op errorfs.Op) error {
			if op.Kind.ReadOrWrite() == errorfs.OpIsWrite && crashIndex.Add(-1) == -1 {
				// Allow an arbitrary subset of non-0synced state to survive beyond the

nit: "non-synced"

[RaduBerinde]

TFTR!