Long delay if ipam asks an absent host for space; can break launch-dns

[bboreham]

When one allocator needs more space, it picks another peer at random to ask for space. If it picks one that is no longer in the network then the message will be dropped; it will be retried when something else happens, but that may be 30 seconds later, on a timer-driven gossip update.

If the program that needs an IP address has a time-out shorter than 30 seconds, as weaveDNS does, then this will inevitably lead to failure.

A basic mitigation would be to pick a different peer if the chosen target is not even in the peer topology, but fixing this may require some crossing of layer abstractions.

[rade]

The way to do this w/o crossing layer abstractions is to make GossipUnicast return an error when something goes wrong - currently it only ever returns nil.

We need some spin avoidance for that though, e.g. only try a peer once; if all have been tried revert to the current mechanism (which is to wait for a gossip update, as I understand it).

[rade]

@bboreham please update the title and description here, making it clear that this isn't just a 'performance' issue.