etcd auto-restore can cause rare race condition and overwrite

Detected an auto-restore bug which can happen when etcd is down, and the broker tries to snapshot into a snapshot the operator uses to restore etcd before the etcd auto-restore can copy the snapshot.
Solution: we now define a dedicated bucket ```__etcd__``` to separate snapshots the broker holds. Before we let the broker decide.