internal-rest-server

ControlledShutdown without invoking the rest of the broker shutdown logic.
This is useful for forcing a broker out of the cluster without bringing
down the external endpoints. This is necessary because in AWS, a broker
which receives SIGTERM can result in external unavailability before
controlled shutdown is complete. By having an external service trigger
`beginShutdown`, the broker can cede leadership before receiving SIGTERM.

This PR also introduces a Jetty REST server along with a handler which can be used to trigger the beginShutdown hook.