Manual leaving of safe mode may lead to data lost

Due to HADOOP-4610, NameNode calculates mis-replicated blocks when leaving safe mode manually, where it clears the pending deletion queue before it does the calculation. This works fine when NameNode just starts but introduced a bug when NameNode is running for a while. Clearing the pending deletion queue makes NameNode not able to distinguish valid replicas from invalid ones, ie, the ones that have scheduled or dispatched for deletion. Therefore, NameNode may mistakenly decide the block is over-replicated and choose all valid ones to delete.