[chaserhkj]

Currently in branchfs, rmdir calls do not check if the directory being removed is empty before setting the tombstone for the directory. And at change commit time the directory is removed without checking any surviving children, either.

However this is in conflict with the POSIX specifications (ref):

The rmdir() function shall remove a directory whose name is given by path. The directory shall be removed only if it is an empty directory.

This can lead to serious data loss since a lot of tools expect the POSIX behavior. For example when removing a file in a git repo via git rm, git automatically calls rmdir recursively on all parent directories of that file to prune any stale dir entries expecting it to return ENOTEMPTY. On branchfs it will just prune everything in the git repo, and upon commit will mirror the changes and delete everything.

This PR:

• Fixes this behavior by properly implementing POSIX-compliant rmdir
• Adds safe guard in commit stage, rejecting changes that tombstones directories without tombstoning all the children.
• Adds regression tests for the changes