rm-rf: make sure we can safely remove dirs we have no access to via rm_rf_at()

rm-rf: make sure we can safely remove dirs we have no access to via rm_rf_at()

Previously, we'd first empty a dir, and then remove it. This works fine
as long as we have access to a dir. But in some cases (like for example
a foreign owned container tree) we might not have access to the dir, but
are still able to remove it (because it is empty, and in a dir we own).
Hence let's try that first. If it works, we do not need to enter the dir
(and thus fail).