vm: abort and report error if domain destroy fails

The call of vm._dom.destroy() is not expected to fail.
However, if the failure is not impossible, and in
that case VDSM should detect that and report the
error instead of blindly go ahead.

This patch let releaseVm() bail out with an error
as soon as possible if destroy() fails.

Due to entanglement of the error floes, the more correct
way to handle this error conditions is also the nicer,
by splitting the destroy attempts into submethods.

Change-Id: Id6d5819321cd0cb28aa43678dc65ee83c215c2d7
Signed-off-by: Francesco Romani <fromani@redhat.com>
Reviewed-on: http://gerrit.ovirt.org/28025
Reviewed-by: Dan Kenigsberg <danken@redhat.com>