recoverd: Call takeover fail callback only once per node

recoverd: Call takeover fail callback only once per node

Currently the fail callback is called once per (takeip/releaseip) control
failure.  This is overkill and can get a node banned much too quickly.

Instead, keep track of control failures per node and only call fail
callback once per failed node.

Signed-off-by: Martin Schwenke <martin@meltin.net>
Pair-programmed-with: Amitay Isaacs <amitay@gmail.com>
(cherry picked from commit bf4a7c1ad87e0e848296d15d63eb8cd901ca5335)

Conflicts:
	server/ctdb_takeover.c