multipath_fallback should be optional

The current (and historic) behaviour is that when multipath setup fails for a volume attachment, we fall back to the non-multipath device. IMO, when multipath is configured, it should be used always, and if it fails, the volume connection should fail. Otherwise a problem can go unnoticed, and create further problems later. We should have an option, perhaps "multipath_fallback", which could default to True (to preserve legacy default beheviour).

I suppose that we'll need changes in nova and cinder-volume, to adopt the new option. Not sure if that should be handled in separate bugs, or combined in this one (?)