ceph: services: allow rolling restarts past the cephx cipher checks

Ceph 19.2.6 and 20.2.4 added the aes256k cephx key type. Every
upgraded cluster reports the keys that are not migrated yet as
insecure, two of those checks as HEALTH_ERR. Rolling restarts were
then refused on every upgraded cluster, so daemons stayed on the old
build and the web interface offered no way to continue.

Blocking on these checks is also circular. A key can only move to
aes256k once every monitor in the quorum supports that cipher, and for
that the rolling restart has to finish first. The per-daemon
ok-to-stop check still gates every step.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>