Recent customer issues have highlighted problems with storage
accounting, namely that while there are quotas and reservations for
individual Crucible regions, there's nothing set for the whole Crucible
dataset. Crucible _could_ end up using the whole disk, or some large
fraction of it, such that other users of the same U2 could be starved
out.

This commit adds a buffer to each zpool that the Crucible region
allocation query will not allocate into. This overhead will be set to
250G initially (see oxidecomputer#7875 for reasoning) but could
also be modified with omdb.

Part of this commit's changes include using a CTE with
`regions_hard_delete`, which is much more efficient than the previous
for loop but has the effect of overwriting `size_used` for all datasets,
which will undo any time this column value was manually set to prevent
allocation for particular datasets / pools. Because of this, this commit
also adds a `no_provision` flag for a Crucible dataset: if it is set,
then the region allocation query will not allocate into that dataset.
This flag can be toggled with omdb.

Part of the upgrade to R14 will include a support procedure to address
if the addition of the control plane storage buffer of 250G causes a
Crucible dataset to be "overprovisioned", necessitating manually
requested region replacement requests to reduce the size allocated for a
particular Crucible dataset. This commit adds an omdb command to show
all overprovisioned crucible datasets, and changes the region listing
command so it can list regions for a particular dataset.

Fixes oxidecomputer#3480