feat(instances): a VM's destruction says what goes, and keeps what a kept file needs

The Destroy tab was a sub-tab with one sentence and a link; its
confirmation page said only "This action is irreversible!" over a
"Remove Instance's data" switch. The tab now shows the state and
"Review destruction". The owner chose the confirmation layout from
three rendered options: the VM and its host, that its definition,
saved state and snapshot records go and that a running VM is forced
off, two plans for the files (delete the disk files, or keep them), the
VM's disks, what is always kept, the NVRAM choice, and Cancel.

Codex reviewed destroying; this is fixed:

- A disk file that cannot be deleted keeps the files below it, which
  it needs: they were deleted after it, leaving it broken. The files
  are deleted overlays first (split_disk_paths_by_use orders them by
  how many files each grows from), and if the files a kept one needs
  cannot be read, none of the rest goes. A message names each file
  kept so, and a failed deletion says the VM is removed.

vrtManager/tests/test_cloud_init_seed.py

@@ -91,6 +91,7 @@ class DeleteWithDisksTestCase(unittest.TestCase):
         vm.get_disk_devices = lambda: [{"path": "/pool/web-1.qcow2"}]
         vm._snapshot_chain_files = lambda own: []
         vm.paths_used_by_other_domains = lambda own: set()
+        vm.backing_path = lambda path: None
         pool = MagicMock()
         if seed_in_pool:
             pool.storageVolLookupByName.return_value.path.return_value = f"/pool/cidata-{UUID}.iso"