deploy: disable configured `service_name` on secondary target hosts

The new functionality is controlled via a disable-secondary flag that can be appended to a service specified in service_name. Primary hosts will still be restarted or reloaded as before.

The provisioner/configuration manager of our target hosts (normally Puppet) is responsible for marking a host as secondary using the file specified in secondary_host_signal_file

Bug: T343447