Add an option to fail wal recovery when lease recovery fails

Currently, if lease recovery doesn't succeed over an extended timeout (default 15 minutes), then we issue a log message about possible data loss and continue with recovering the edits in that file.

In some deployments this potential for dataloss might be unacceptable. In those situations it would be good to have a configurable setting that marks the recovery failed instead. Should default to off (at least in branch-1)