JournalSpec zone restrictions

[jgraettinger]

Today brokers provide a guarantee that a JournalSpec with R > 1 will be replicated across at least two zones. There's no ability to constrain which zones are selected.

As an operator, I'd like to be able to restrict a JournalSpec to a configured set of zones. Only brokers running in those zones would be eligible for replicating the journal. With configurable restrictions, I can:

• "Home" a journal to a specific cloud region when running a multi-region Gazette broker deployment.
• Restrict a journal to a single zone, to save on inter-zone transfer costs for journals which desire >1 broker replica but can tolerate an entire-zone failure.