Limit vbucket "max_cas"

set/del with meta can update the CAS of a vbucket to any value - a faulty input can "poison" the max_cas of the vbucket - affecting the hybrid logical clock logic (and impacting LWW XDCR).

KV should add a configurable limit on how far in the future from the local clock a CAS value can be.

This would introduce a new error path for set/del meta which XDCR may need to handle Neil Huang