Replication clients should not access zookeeper directly

Replication client actions set and modify znodes directly. This is legacy from an era before we had the AccessController available and missing coverage of admin action in our security model.

All replication client actions should be mediated by the master, and hooked up to the coprocessor framework for use by the AccessController. After adding this functionality we should should restrict access to replication znodes to only the HBase service principal, but provide a configuration option to relax those permissions for as long as older admin clients are in use (with a stern suggestion to upgrade ASAP). This type of functional change, with optional backwards compatibility, should be fine for all branches.