Cassandra catalog migrations: agreement waits per account keyspace, no retry of a timed-out statement, no two-datacenter test #686

Parts of the Cassandra catalog migrations that #681 leaves as they are:

• The status waits for schema agreement before it reads each account keyspace's ledger, so every status read costs one agreement round and two reads per account keyspace. The status is read when serve starts and by migrate and verify, so a deployment with many accounts pays this at each of them.
• A statement sent under the migration lock that times out (no answer within 20 s from a loaded node) fails the run and is not retried. Every statement of a body can be sent again, so the next migrate --yes finishes the run, and the upgrade manual says so. Retrying the codes connect.rs already classes as transient would save the operator that second run.
• No test runs the migrations on a cluster with two datacenters. The lock is written at SERIAL and the server registrations are read at ALL, which reach every datacenter's replicas, but the two-node job runs one datacenter.