zulip-puppet-apply: Any resources failing to apply should exit 2.

The existing `except subprocess.CalledProcessError` only catches if
there are syntax errors which prevent the `lastrun` file from being
written; it does not handle if there are properly-defined resources
which fail to evaluate (e.g. due to a missing dependency or file).

Check the `failed` resource count, and exit 2 if there are any such
resources.  This will cause `zulip-puppet-apply --force --noop` (which
is used as a pre-flight check during upgrades) to properly detect and
signal on more types of invalid puppet configurations.  In turn, this
will cause `upgrade-zulip` to not attempt to power through upgrades it
knows are destined to fail.

scripts/zulip-puppet-apply

@@ -82,7 +82,10 @@ def noop_would_change(puppet_cmd: List[str]) -> bool:
 
         with open(lastrun_file.name) as lastrun:
             lastrun_data = yaml.safe_load(lastrun)
-            return lastrun_data.get("resources", {}).get("out_of_sync", 0) != 0
+            resources = lastrun_data.get("resources", {})
+            if resources.get("failed", 0) != 0:
+                sys.exit(2)
+            return resources.get("out_of_sync", 0) != 0
     except subprocess.CalledProcessError:
         sys.exit(2)
     finally: