Add "bup rm", but require --unsafe invocation

Add "bup rm", but require --unsafe invocation

Allow the removal of branches, and the removal of saves from specified
branches.  This command only removes the references, so until "bup gc"
is available, all of the related data will still be in the repository,
though possibly difficult to reach, unless otherwise tagged.

This command is potentially dangerous, so until we've had broader
testing, require all invocations to specify --unsafe, and make it clear
in the documentation that this command isn't considered stable.

Thanks to Nix for reporting an earlier mistake in the manpage.

Signed-off-by: Rob Browning <rlb@defaultvalue.org>
Tested-by: Rob Browning <rlb@defaultvalue.org>