Ref T4571. This allows individual connections to be flagged as "read-only". If we try to send writes over a read-only connection, the connection layer throws an exception.

This is part of moving toward a world where we degrade gracefully if the master database is unreachable, and can spread reads to replicas.

See next revision, which adds a basic read-only mode.