Make pressure alarms and control more robust

Add a new pressure keyword, giving both a measurement and the selected measurement source. I can't decide on a name, but maybe:

cryostatPressure=$source,$pressure
  where $source is:
    - "interlock" above 1 Torr
    - "iongauge" below that, if the ion gauge is working.
    - "ionpumps" if the gauge is broken but both pumps are on. Use average of two.
    - "ionpump1" or "ionpump2" if only one is working.
    - "none" if nothing is working

Switch to using only that measure to control whether to raise a pressure-high alarm or to shut the ion pumps down. Have different thresholds for the two actions. Apply a short de-glitching filter.

Keep all existing gauge/pump/interlock keywords.

Keep per-pump shutdown logic, but raise the threshold fairly significantly, and apply a de-glitching filter.

Add a setTemporaryLimit <pressure> <minutes> manual override for humans turning the pumps on. The human becomes entirely responsible during that time.

Besides this software work, we should make one hardware reconfiguration: the two ion pumps for any given camera should be split across the two 4UHV controllers. The intent would be to avoid any problems on one controller affecting both pumps on one cryostat. Or possibly both pumps on two cryostats.

Since we don't want to do this again can, say, fmadec and rousselle comment?