…#7447)

Pulled out of #7076

This PR is a partial implementation of RFD 522

It adds:
- Affinity and Anti-Affinity groups, contained within projects. These
groups are configured with a **policy** and **failure domain** can
currently contain zero or more **members**. Affinity groups attempt to
co-locate members, anti-affinity groups attempt to avoid co-locating
members.
- **Policy** describes "what to do if we cannot fulfill the co-location
request". Currently, these options are "fail" (reject the request) or
"allow" (continue with provisioning of the group member regardless).
- **Failure Domain** describes the scope of what is considered
"co-located". In this PR, the only option is "sled", but in the future,
this may be expanded to e.g. "rack".
- **Members** describe what can be added to affinity/anti-affinity
groups. In this PR, the only option is "instance". RFD 522 describes how
"anti-affinity groups may also contain affinity groups" -- which is why
this "member" terminology is introduced -- but it is not yet
implemented.
- (anti-)Affinity groups are exposed by the API, through a CRUD
interface
- (anti-)Affinity groups are considered during "sled reservation", where
instances are placed on a sled. This is most significantly implemented
(and tested) within `nexus/db-queries/src/db/datastore/sled.rs`, within
#7446

Fixes #1705