What is the minimum number of manager nodes required so that a Docker Swarm can tolerate the failure of one manager?