VPS subdataset destroy with proper umount

Destroyed datasets and all its descendants are first umounted,
then destroyed and finally mount action scripts are regenerated.
Dataset: add column user_destroy

Used to deny user to destroy datasets.
Vps.Dataset#Delete: improve access control

User can now destroy only datasets that he owns and has access
to it. Dataset query has also been improved, so that
it does not match VPS private area and datasets outside
of the VPS subtree.

Note that when child dataset has user_destroy = false, but one
of its parents has user_destroy = true, the user will be able
to destroy the parent dataset, which will result in destroying
the child datasets as well.