index-only scans versus serializable transactions

By not visiting the heap page for tuples, index-only scans fail to
acquire all of the necessary predicate locks for correct behavior at
the serializable transaction isolation level.  The tag for the
tuple-level predicate locks includes the xmin, to avoid possible
problems with tid re-use.  (This was not covered in initial
pre-release versions of SSI, and testing actually hit the problem.)
When an "index-only" scan does need to look at the heap because the
visibility map doesn't indicate that the tuple is visible to all
transactions, the tuple-level predicate lock is acquired.  The best
we can do without visiting the heap is a page level lock on the heap
page, so that is what the attached patch does.

If there are no objections, I will apply to HEAD and 9.2.

-Kevin