spa load/import should trust the MOS config as soon as it can
When opening or importing a storage pool, we trust the provided config (which may be from the zpool.cache file, or discovered from devices' labels) to various degrees. We should trust it only until we read the config from the MOS, at which point we should switch entirely to the MOS config and re-evaluate everything about the pool (e.g. how many top-level VDEVS it has). We may need to keep a small amount of info from the provided config, like the device paths.
This will allow us to be more flexible about importing damaged pools, because the provided config may not be able to be entirely accurate, but we know that the MOS config is consistent with the rest of the pool state.