automatic rollback

[JohnMurray]

While running an alter, when encountering failure, we do one of two things:

1. output the error and stop running up alters
2. output the error and continue running alters, assuming that the -f flag is provided to the command

I am proposing either an alternative behavior for no. 1 or a new behavior (driven by configuration) in which, when we encounter an error we also attempt to do a rollback (running the down alter).

The open question is whether or not this should be done for the -f option or not. An argument could be made either way as to the semantics of the -f option. We might also be able to introduce a new option which ignores rollbacks on a force.

Since -f means "force" I feel the semantics should imply that we drop safety features like automatic rollback and leave it as a "run at your own risk" kind of feature.