Feature Request: Allow ERS callers to require a minimum GTID set on the new primary

Feature Description

Let the caller of EmergencyReparentShard require that the new primary has already executed a given GTID set. If no candidate meets it, the reparent fails.

Use Case(s)

Today ERS only compares candidates to each other. If every candidate lost the same relay log, for example after CHANGE REPLICATION SOURCE TO or a restart with relay_log_recovery=1, they all look fully applied and ERS promotes a stale replica. The transactions at risk are everything since the SQL thread stopped.

VTOrc stores the primary's gtid_executed on every poll. On an automated failover it can pass the last value it saw, so a stale promotion fails loudly instead. The transactions at risk shrink to one VTOrc poll interval.