pgsql: Reject incremental backups based on a backup from a divergent hi

Reject incremental backups based on a backup from a divergent history

After a failover, an incremental backup could accept a prior backup
whose WAL range extends beyond the point where the new primary left the
old timeline. Combining these backups could retain pages from the
abandoned history, producing a corrupt backup that might still recover
and start successfully.

The validation checked the end of the prior backup's final WAL range
against the new backup's start LSN, but not against the timeline's
switch point. This allowed an incompatible prior backup to pass
validation once the new primary had advanced far enough.

Reject incremental backups if the prior backup's final WAL range
extends beyond the timeline's switch point.

Backpatch to v17, where incremental backup was introduced.

Author: Sai Pranav <rajasaipranav0(at)gmail(dot)com>
Co-authored-by: Fujii Masao <masao(dot)fujii(at)gmail(dot)com>
Discussion: https://postgr.es/m/CAPHduZC9pWm_vjznmhZNFsDZKLimqc6dKXOozLUKZVPs19zbZg@mail.gmail.com
Backpatch-through: 17

Branch
------
REL_19_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/04ea11d0e537312e834b90bd782238c54622b802

Modified Files
--------------
doc/src/sgml/backup.sgml | 7 +++++++
src/backend/backup/basebackup_incremental.c | 13 +++++++++++++
src/bin/pg_combinebackup/t/008_promote.pl | 29 +++++++++++++++++++++++++++++
3 files changed, 49 insertions(+)