Disallow setting client_min_messages > ERROR?

There's a thread on the ODBC list[1] complaining about the fact that
it's possible to set client_min_messages to FATAL or PANIC, because
that makes ODBC misbehave.  This is not terribly surprising, because
doing so arguably breaks the frontend protocol.  The simple-query
section says this:

    In the event of an error, ErrorResponse is issued followed by
    ReadyForQuery.

and the extended-query section says this:

    Therefore, an Execute phase is always terminated by the appearance of
    exactly one of these messages: CommandComplete, EmptyQueryResponse (if
    the portal was created from an empty query string), ErrorResponse, or
    PortalSuspended.

and both of those are lies if an ERROR response gets suppressed thanks to
client_min_messages being set too high.  It seems that libpq+psql manages
to survive the case (probably because psql is too stupid to notice that
anything is wrong), but I don't find it unreasonable that other clients
get hopelessly confused.

Hence, I propose that we should disallow setting client_min_messages
any higher than ERROR, and that this probably even amounts to a
back-patchable bug fix.

Thoughts?

			regards, tom lane

[1] https://www.postgresql.org/message-id/flat/EE586BE92A4AFB45B03310C2A0C0565D6D0EFC17%40G01JPEXMBKW03