Safeguard XDCR against cross-node failover and data loss: provide a way to replicate only mutations replicated-to or persisted-to another replica.

Today if XDCR replication runs ahead of local replication across replicas and a failover happen to a replica that is behind XDCR replication in up to date--ness, XDCR ignores the rollback/dataloss that happen and may ignore new incoming updates after the cross node failover. We need a way to prevent this from happening.