recovery: allow disabling a in-recovery service

recovery: allow disabling a in-recovery service

Mostly for convenience for the admin, to avoid the need for removing
it completely, which is always frowned uppon by most users.

Follows the same logic and safety criteria as the transition to
`stopped` on getting into the `disabled` state in the
`next_state_error`.

As we previously had a rather immediate transition from recovery ->
error (not anymore) this is actually restoring a previous feature and
does not adds new implications or the like.

Still, add a test which also covers that the recovery state does not
allows things like stop or migrate to happen.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>