xenapi: stop destroy_vdi errors masking real error

We frequently call destroy_vdi in an exception block where we plan to
re-raise the exception.

Should an error occur while destroying the vdi this hides the real error
that caused the problem. To stop this, I have moved those calls to
safe_destroy_vdis and added unit tests to ensure the error from
destroy_vdi does not mask the real issue.

Closes-Bug: #1246276
Change-Id: Ib02f93ab1086f077d3d00e5ca915a26f90552c85
Merge "xenapi: stop destroy_vdi errors masking real error"