Allow extensions to run hooks *before* an object is destroyed.

This would easily allow to do things like:

• before you actually destroy a profile picture, find its active usages and set the builtin profile image (T16074)
• before you actually destroy something at midnight, allow extensions to throw violently and effectively impede destruction saying "please go to sleep first" in the exception message, visible from command line.

Closes T16079
Ref T16074

Try to destroy something (./bin/remove destroy). Absolutely no regressions.