Prevent taking the DDL lock without explicit authorization

Prevent taking the DDL lock without explicit authorization

Attempts to acquire the global DDL lock will now, by default,
ERROR with a message like:

ERROR: Global DDL locking attempt rejected by configuration
DETAIL: bdr.permit_ddl_locking is false and the attempted command would
require the global DDL lock to be acquired. Command rejected.
HINT: See the 'DDL replication chapter of the documentation.

Users/scripts which wish to execute DDL should:

BEGIN;
SET LOCAL bdr.permit_ddl_locking = true;
ALTER TABLE ....
COMMIT;

This will help prevent accidental DDL in things like user reports
from aborting transactions across the system and blocking user
writes. It's particularly useful where the DDL may be combined
with a transaction that does a large amount of row changes, as
there are performance issues with transactions that both do
DDL and change very large numbers of rows.

Future work will focus on progressively making the DDL lock finer
grained and less disruptive.