pgsql: Reject incremental backups based on a backup from a divergent hi

Reject incremental backups based on a backup from a divergent history

After a failover, an incremental backup could accept a prior backup
whose WAL range extends beyond the point where the new primary left the
old timeline. Combining these backups could retain pages from the
abandoned history, producing a corrupt backup that might still recover
and start successfully.

The validation checked the end of the prior backup's final WAL range
against the new backup's start LSN, but not against the timeline's
switch point. This allowed an incompatible prior backup to pass
validation once the new primary had advanced far enough.

Reject incremental backups if the prior backup's final WAL range
extends beyond the timeline's switch point.

Backpatch to v17, where incremental backup was introduced.

Author: Sai Pranav <rajasaipranav0(at)gmail(dot)com>
Co-authored-by: Fujii Masao <masao(dot)fujii(at)gmail(dot)com>
Discussion: https://postgr.es/m/CAPHduZC9pWm_vjznmhZNFsDZKLimqc6dKXOozLUKZVPs19zbZg@mail.gmail.com
Backpatch-through: 17

Branch
------
REL_18_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/2afbad0cedfd4184bd13d470e7fdc13c94d1ab77

Modified Files
--------------
doc/src/sgml/backup.sgml | 7 +++++++
src/backend/backup/basebackup_incremental.c | 13 +++++++++++++
src/bin/pg_combinebackup/t/008_promote.pl | 29 +++++++++++++++++++++++++++++
3 files changed, 49 insertions(+)