scripts/nixops: Add --wipe argument to "destroy".

This currently doesn't have any functionality yet but allows backends to
implement a mechanism for securely erasing data on the corresponding
resources/disks.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
hetzner: Implement destroy() method.

Our approach is to put the machine into rescue mode, maybe wipe disks
there, unregister stuff from the Robot and leave the machine in the
rescue system. That way a backgrounded wiping process can continue to
run for hours or days while the machine can be cancelled at Hetzner at
the next possible cancellation date and still being wiped in the end.

Of course, in order to remove the administrator account from the robot,
we need to have the credentials for the main Robot, so destruction isn't
possible without these credentials.

In addition, this adds a new boolean keyword argument "bootstrap" to
reboot_rescue(), so that we don't end up having the bootstrap installer
on the rescue system which we're going to destroy anyway.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>