Make `OS.Dir.delete ~recurse:true` secure to symlink attacks.

[dbuenzli]

The implementation introduced in 8d15b141a0c903fedacf61e is vulnerable to that kind of attack.

[dbuenzli]

Also it may be worth introducing an error handling mecanism in the vein of the folding functions.