Proving the Correctness of Disk Paxos in Isabelle/HOL