RELAY2: only some members can become site masters

Currently, every node in a local cluster (site) can become site master (relaying messages between sites). This requires an internal and external NIC; the former to talk to the local cluster nodes, and the latter to talk to the remote sites.
If only a few nodes have multiple NIC, and/or access to the external world, then we should be able to restrict who can become a site master and who cannot.
E.g. if we have view

, then perhaps only A and C can become site masters. In this case, if A crashes or leaves, then C should become the new site master.
Investigate how feasible it is to implement selective site masters.