On destroy, retain the DynamoDB table by default (if it has anything in it).

## Overview

We don't want to accidentally delete important data.

## Deliverables

- [ ] figure out how to retain the DB and make sure it doesn't cause a false error when it fails to delete
- [ ] implement `--destroy-data` option that will delete the DB
- [ ] check if DB is empty, in which case we always delete it
- [ ] add a `retained` section to `cloudsite-db.json` which is like `cleanup` described in #93, except it lists retained items.
- [ ] implement `cloudsite retained list`, `cloudsite retained list --arn` which can reuse the logic from cleanup
- [ ] implement `cloudsite retained delete XXX [YYY...]` which deletes the specified resources reusing the logic from cleanup

Start by reading the existing cleanup logic referenced in #93 and the cloudsite-db.json structure. Define the retained resource behavior and implement the listed cloudsite retained commands, including empty-table deletion and the --destroy-data override; done means retained resources are listed and selectively deleted without false destroy errors.

Written by the indexing model from the issue text.