storage controller: shard splitting error handling/rollback

[jcsp]

See RFC #6358

Two recovery paths are needed:

• On startup, when we see that some tenant shards have a splitting state
• During runtime, when something inside the tenant_shard_split function fails, and we need to leave things in a clean state.