pgsql: Reject incremental backups based on a backup from a divergent hi

Reject incremental backups based on a backup from a divergent history

After a failover, an incremental backup could accept a prior backup
whose WAL range extends beyond the point where the new primary left the
old timeline. Combining these backups could retain pages from the
abandoned history, producing a corrupt backup that might still recover
and start successfully.

The validation checked the end of the prior backup's final WAL range
against the new backup's start LSN, but not against the timeline's
switch point. This allowed an incompatible prior backup to pass
validation once the new primary had advanced far enough.

Reject incremental backups if the prior backup's final WAL range
extends beyond the timeline's switch point.

Backpatch to v17, where incremental backup was introduced.

Author: Sai Pranav <rajasaipranav0(at)gmail(dot)com>
Co-authored-by: Fujii Masao <masao(dot)fujii(at)gmail(dot)com>
Discussion: https://postgr.es/m/CAPHduZC9pWm_vjznmhZNFsDZKLimqc6dKXOozLUKZVPs19zbZg@mail.gmail.com
Backpatch-through: 17

Branch
------
REL_17_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/ecb43083fe34ebd2b00263c90dcf1ffc63b4c2a4

Modified Files
--------------
doc/src/sgml/backup.sgml | 7 +++++++
src/backend/backup/basebackup_incremental.c | 13 +++++++++++++
src/bin/pg_combinebackup/t/008_promote.pl | 29 +++++++++++++++++++++++++++++
3 files changed, 49 insertions(+)