Prevent pattern of bugs caused by calling get_options() within options_validate() etc

In #22252 (moved) and elsewhere, we hit a problem with calling a function that called get_options() -- both directly and via networkstatus_get_latest_consensus() -- before the options were fully assigned.

We ought to do something to eliminate this pattern of bugs.

One possibility might be to 'fill in' the new options before they're completely validated. But we'd want to be able to roll back to the old options as needed if the new options didn't validate.