From: NeilBrown <neilb@cse.unsw.edu.au>

Currently if there are two failed drives, and two spares are added, then
recovery starts onto the first spare, but never notices the second spare.  To
cope, we set RECOVERY_NEEDED when recovery finishes so that we re-check.