config: add safe startup mode

If the startup may take a long time (reads of an existing snapshot or
fetches it from a remote master), then

* If there are other instances in the replicaset, force the read-only
  mode on the database startup[^1].
* After the database startup, re-read the configuration and apply the
  fresh one (now without any RO/RW mangling).

If the startup shouldn't take a long time[^2], the configuration is
read and applied once.

[^1]: The read-only mode is not forced if there is no existing snapshot.
      It may lead to missing bootstrap leader in the replicaset. See
      details in the comment in the box_cfg applier code.
[^2]: There is the only case that we consider as such: startup of an
      instance without an existing snapshot without other instances in
      the same replicaset.

Part of #8810

NO_DOC=the old behavior was not released, the documentation request will
       be registered manually
NO_CHANGELOG=see NO_DOC
NO_TEST=it is not trivial to verify automatically