Automatic merge from submit-queue (batch tested with PRs 56108, 56811, 57335, 57331, 54530). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

api: validate container phase transitions

https://github.com/kubernetes/kubernetes/issues/54499 exposed an issue where a container was transitioning from the terminal phases of `Succeeded` or `Failed` to `Pending`.  It is due to a bug in the kubelet, but additional validation in the API server can prevent this invalid phase transition from being accepted.

@smarterclayton @derekwaynecarr @dashpole @joelsmith @frobware 

I confirmed that the reproducer in https://github.com/kubernetes/kubernetes/issues/54499 does not work with this validation in place.  The erroneous kubelet status update is rejected:
```
status_manager.go:437] Failed to update status for pod "test_default(2f02ecdf-b92a-11e7-a2d0-1c1b0deeddfa)": Pod "test" is invalid: status.containerStatuses[0].state: Forbidden: may not be transitioned to non-terminated state
```

However, it only works to a point with this particular issue.  The termination hangs and eventually the resource is removed from etcd and the status update goes through because there is no old statuses to compare.  Not exactly sure how this happens since there is no pod in etcd anymore  ¯\\_(ツ)_/¯