The option group_replication_exit_state_action configures how Group
Replication behaves when a server leaves the group unintentionally:
 1. after encountering an applier error;
 2. after encountering an recovery error;
 3. in the case of a loss of majority;
 4. when another member of the group expels it due to a suspicion
    timing out;
 5. after an error on coordinated group changes[1];
 6. after a primary election error;
 7. after a clone provisioning error;
 8. when automatic rejoin is enable, after its attempts are
    exhausted unsuccessfully.

This behavior can be:
 * READ_ONLY    disable writes on the server, by enabling
                server super_read_only[2] option;
 * ABORT_SERVER shutdown the server.

After this worklog is implemented, a new behavior is added:
 * OFFLINE_MODE close all connections and disallow new ones from
                users who do not have the CONNECTION_ADMIN or SUPER
                privilege, by enabling server offline_mode[3] option.
                OFFLINE_MODE includes the behaviour of READ_ONLY.

This automatic connection closure will avoid user sessions to:
1) read stale data and 2) write data to orphans servers, without the
need to shutdown the server.

USER INTERFACE
--------------
The DBA can specify the behaviour by setting the option:
 - name: group_replication_exit_state_action
 - values: { READ_ONLY, ABORT_SERVER, OFFLINE_MODE }
 - default: READ_ONLY
 - scope: global
 - dynamic: yes
 - replicated: no
 - persistable: PERSIST, PERSIST_ONLY
 - credentials: SYSTEM_VARIABLES_ADMIN
 - description: The action that is taken when the server
                leaves the group unintentionally.
                Possible values are READ_ONLY,
                ABORT_SERVER and OFFLINE_MODE.

ReviewBoard: 21931