Admin can roast the cluster with a bad config

Authenticated admins can effectively destroy the ONOS cluster by inputting an invalid configuration. For example, a cluster configuration uploaded via the REST API that points to a non-existent node can cause the cluster to hang. ONOS should perform validation to ensure new nodes are reachable when such operation critical changes are made. Additionally, we may want to support a mechanism for automatically rolling back to an old configuration when the cluster becomes unavailable for some time after a configuration change. These are just some ideas. How we should handle invalid configuration changes can and should be debated.