Teach pg_upgrade to deal with invalid databases

Hi,

Reviving this thread [1] on the subject for PG20.

Currently, pg_upgrade fails when it encounters an invalid database
(commit c66a7d75e65, a database whose DROP DATABASE got interrupted)
in the source cluster, blocking the whole upgrade workflow. In the
previous thread, various options were discussed such as skip or drop,
and commit f638aafd1ea tightened checking and error reporting for
invalid databases.

I think we can do better here. If a user decided to DROP a database,
the data in it is no longer wanted. Even if it were, the data in the
files is unlikely to be consistent or useful, since DROP was
interrupted mid-operation (while evicting buffer pool pages, unlinking
files, etc.).

I would like to propose an option to skip the invalid databases, with
the default being on. This helps unblock upgrade workflows while still
preserving them for users who think it is necessary. Please find the
attached patch doing this.

Dropping the invalid databases during the upgrade is another approach,
but it could be costly, especially with large buffer pools and a large
number of files to unlink. Skipping them instead is simpler, and the
old directory contents would be cleaned up by the removal script that
pg_upgrade already generates.

Thoughts?

Thanks to Nathan Bossart and Robert Treat for earlier discussions and
design review.

[1] https://postgr.es/m/f9315bf0-e03e-4490-9f0d-5b6f7a6d9908%40postsubmeta.net

--
Bharath Rupireddy
Amazon Web Services: https://aws.amazon.com