Drop unexpected Pacemaker frames instead of terminating the daemon; mark Pacemaker as deprecated

[rzo1]

Robustness: drop unexpected Pacemaker frames

A CONTROL_MESSAGE frame is decoded by the Pacemaker ThriftDecoder into a ControlMessage. With pacemaker.auth.method: NONE, or after the SASL handler forwarded it upstream, it reached PacemakerServer.received(), which cast it to HBMessage. The ClassCastException ended in StormServerHandler.exceptionCaught, which treats anything but an IOException as fatal and exits the JVM. Malformed requests took the same path.

This mirrors what was recently done for the worker path (#9076):

• The server-side ThriftDecoder only accepts SASL_TOKEN_MESSAGE_REQUEST (the control message a client sends to start the DIGEST handshake). Other control frames, and control frames with a missing/short/unknown payload, are discarded and the connection closed. SASL_MESSAGE_TOKEN and HBMessage frames decode as before, so DIGEST and KERBEROS handshakes are unchanged. On the client side a malformed control frame surfaces as an IOException, so PacemakerClientHandler reconnects as before.
• PacemakerServer.received() checks the message type; anything other than an HBMessage is logged and the connection closed.
• The Pacemaker pipeline uses a new PacemakerServerHandler that closes only the failing connection on an Exception; Errors still go to StormServerHandler. StormServerHandler and the worker messaging pipeline are unchanged.

Tests: new ThriftDecoderTest and PacemakerServerTest.

Mark Pacemaker as deprecated

Since STORM-2693 workers heartbeat to their supervisor, which reports them to Nimbus, so Pacemaker is only kept for backward compatibility (docs/ClusterMetrics.md already says so). This marks the Pacemaker server/client classes, the pacemaker state storage and the pacemaker.* config keys as @Deprecated, and adds a notice to docs/Pacemaker.md and the storm pacemaker help.

[reiabreu]

(Generated with the help of an LLM.)

Nice hardening of the Pacemaker frame handling — the layered decoder / received() type check / PacemakerServerHandler approach looks sound and is well tested, and the DIGEST/KERBEROS handshakes stay intact. A few minor notes:

1. Test gap. Worth adding a SASL_MESSAGE_TOKEN test with a declared payload length exceeding its actual bytes, asserting the connection closes and the daemon survives — the control-frame malformed cases are well covered, but the SASL branch only has a well-formed case.

2. docs/Pacemaker.md. "existing deployments should plan to move back to it" reads as migrating to Pacemaker (nearest antecedent). Suggest naming the target explicitly, e.g. "migrate away from Pacemaker to the default ZooKeeper state store (org.apache.storm.cluster.ZKStateStorageFactory)."

3. PacemakerServer.close(). Appears to have no production caller (only test teardown) — if it's purely test support, a one-line comment saying so would clear up the intent.