New policy: Only use test_expect_failure for broken tests

New policy for tests:

  * For subtests whose commands fail when the test succeeds, use
    test_expect_success and shell negation (!). test_expect_failure is
    to be used only for subtests that are known to be broken.

  * Patches that introduce a subtest failure must change that subtest
    to use test_expect_failure.

The reason for this change is to ensure that the test suite passes at
all times, even in the middle of disruptive rewrites spread over
several commits.

Signed-off-by: Karl Hasselström <kha@treskal.com>