fix schema ownership on first connection v2

Dear hackers,

Please find attached a patch to fix schema ownership on first
connection, so that non system schemas reflect the database owner.

This revised patch includes fixes after Tom comments on names used in the
validation. However, the validation is still there. It is easy to edit it out
if required, but I still think that such a test is a good thing.

(1) It adds a new "datisinit" attribute to pg_database, which tells
whether the database initialization was performed or not.
The documentation is updated accordingly.

(2) The datisnit boolean is tested in postinit.c:ReverifyMyDatabase,
and InitializeDatabase is called if necessary.

(3) The routine updates pg_database datisinit, as well as pg_namespace
ownership and acl stuff.

I think that the race condition if two backends connect for
the first time to the same database is correctly taken care of,
as only one backend will update the datisinit flag and then will fix the
schema ownership.

(4) Some validation is added.

Some questions:

- is the place for the first connection housekeeping updates appropriate?
it seems so from ReverifyMyDatabase comments, but these are only comments.

- it is quite convenient to use SPI_* stuff for this very rare updates,
but I'm not that confident about the issue... On the other hand, the
all-C solution would result in a much longer and less obvious code:-(

- it is unclear to me whether it should be allowed to skip this under
some condition, when the database is accessed in "debug" mode from
a standalone postgres for instance?

- also I'm wondering how to react (what to do and how to do it) on
errors within or under these initialization. For instance, how to
be sure that the CurrentUser is reset as expected?

Thanks in advance for any comments.

Have a nice day.

--
Fabien.