actions/policy: revert new protector links on failure
actions/policy: revert new protector links on failure

Ensure that when an encryption policy is reverted (e.g. due to
encryptPath() failing after the policy was created), we also delete any
new protector links that were created for the policy, as this is not
handled by the logic that reverts new protectors.

google/fscrypt,google/fscrypt,google/fscrypt