Give user option of not auto-restarting instances during update #11708

Once #11504 is merged, when reincarnating instances during an update due to sled evacuation, we ignore the auto-restart policy as the API clearly states that this policy applies only to instances that failed.

Going forward, it would be nice to give users the option of not auto-restarting instances for any reason.

A possible use-case is users running their workload on top of some self-healing infrastructure, where if an instance is temporarily unavailable, their system would just start a new one.