A DDL lock should not be acquired when the DDL service state is not kPrimaryAndRecovered.

Small explanation
This is because we must ensure that a DDL operation that is interrupted and has to release the DDL lock due to a step-down will be the next one acquiring that DDL lock (after stepping up). Therefore, no one else must take a DDL lock right after a DDL operation is interrupted.

Suggested solution
We must ensure the _state is still kPrimaryAndRecovered once the lock is acquired.