Resolves: fdo#70703 guard against FlushImpl inside FlushImpl

where the inner one deletes Shells that the outer one is still
processing. Push the candidates onto a stack and let inner
FlushImpl modify them to inform outer FlushImpl's that an entry
has been deleted

Change-Id: I1db8546d53e24cc96c72f2cd5cbec57b6cecaff5
Reviewed-on: https://gerrit.libreoffice.org/6735
Reviewed-by: Michael Stahl <mstahl@redhat.com>
Tested-by: Michael Stahl <mstahl@redhat.com>