fix(auth): harden tht auth mutations

tools/tht/internal/safeio/replace_windows.go

@@ -47,6 +47,21 @@ func replaceCanonicalRegular(path string, contents []byte) error {
 	return nil
 }
 
+func removeCanonicalPrivateRegular(path string) error {
+	parents, target, err := openCanonicalWindowsParent(path)
+	if err != nil {
+		return ErrUnsafeFile
+	}
+	defer parents.Close()
+	if err := ValidatePrivateRegular(path); err != nil {
+		return ErrUnsafeFile
+	}
+	if err := windows.DeleteFile(windows.StringToUTF16Ptr(filepath.Join(parents.directory, target))); err != nil {
+		return ErrUnsafeFile
+	}
+	return nil
+}
+
 func safeExistingRegular(path string) bool {
 	return ValidatePrivateRegular(path) == nil
 }