Implement destroyed_at timestamping to "delete" objects

Instead of deleting objects, they are marked as "destroyed". This will
eventually be used to undelete objects when necessary as well as to
allow for reporting on "deleted" objects.