[Feature] Recursive scan for unused protectors and policies

Destroying policies and protectors feels like a gamble. After a while, and after some upgrades to `fscrypt`, a user can end up with a lot of encrypted directories scattered over multiple mountpoints, with multiple policies and protectors.

It would be helpful if `fscrypt` could do a recursive scan and list what protectors/policies are _unused within current mountpoints_ so the user feels more at ease deleting them, or `fscrypt` could offer to delete the unused ones.