If auto-failover is impossible because of data loss we should stop trying to auto_failover the node

If for some reason auto-failover fires but can't run to completion (say one of the buckets has zero replicas for instance), it will keep firing every second as long as the auto-failover condition is met. As a critical signal, auto-failover interrupts janitor which can be a problem if janitor is trying to do something that might cause the auto-failover condition to no longer be met (such as bringing a bucket on a node online.) In the case a bucket has no replicas, auto failover can never run to completion and this situation is perhaps best solved by disabling auto-failover (or adding a replica) however, in general we could perhaps handle this situation better.