Fully featured failure domain editing

After #106 (closed) we have limitted ability to change failure domains:

1. the instance must be stopped
2. no way to remove failure domain subdivision

The latter means that if the instance started with arguments:

picodata run --failure-domain planet=Earth --failure-domain owner=Vlad

It cannot be restarted with these arguments:

picodata run --failure-domain planet=Earth