fix(auth): harden tht auth mutations

tools/tht/internal/safeio/files.go

@@ -118,6 +118,15 @@ func ReplaceCanonicalRegular(path string, contents []byte, mode os.FileMode) err
 	return replaceCanonicalRegular(path, contents)
 }
 
+// RemoveCanonicalPrivateRegular removes one existing private regular file without following a
+// symlinked path component. It is intended only for rolling back a file this process published.
+func RemoveCanonicalPrivateRegular(path string) error {
+	if err := ValidatePrivateRegular(path); err != nil {
+		return ErrUnsafeFile
+	}
+	return removeCanonicalPrivateRegular(path)
+}
+
 func randomTemporaryName() (string, error) {
 	bytes := make([]byte, 16)
 	if _, err := rand.Read(bytes); err != nil {