Adds an optional config variable, require_valid_service to check if a
service exists or if a service is masked before attempting to restart
it.

The use-case is when we have a service like jobrunner that should not be
started in the non-active datacenter. Ideally we could mask the service
using puppet, set require_valid_service: True and scap would not
attempt to restart the service for those machines.

Doesn't quite fix, but is part of the fix for T129148.