sql: ensure graceful rollbacks if the ADD REGION async job fails

[arulajmani]

Previously, we assumed that the async component of an
ALTER DATABASE ... ADD REGION wouldn't fail. This isn't really true
though, because users may cancel jobs or we may be dropping regions in
the same txn that fails validation.

We have validation that ensures every region (READ ONLY or PUBLIC) on
the multi-region type descriptor is also present on the database
descriptor's region config (and vice-versa). If we realize that a region
can't be promoted from READ ONLY to PUBLIC, we must also remove it from
the database descriptor's region config (in addition removing it from
the type descriptor). Prior to this patch we didn't do so, and cleanup
could potentially fail validation. This patch fixes that behavior. This
is a temporary band-aid until we stop denormalizing region values and
have a single source of truth.

Release note: None

[cockroach-teamcity]

This change is 

[otan]

Reviewed 2 of 2 files at r1.
Reviewable status: complete! 0 of 0 LGTMs obtained (waiting on @ajstorm and @arulajmani)

---

pkg/sql/multiregion_test.go, line 205 at r1 (raw file):

	if count != 1 {
		t.Fatal("expected crdb_internal_region to be present in system.namespace")

nit: delete

[arulajmani]

TFTR!

bors r=otan

[craig]

Build succeeded:

• GitHub CI (Cockroach)