recovery: make dedupe gc interruptable

The current gc approach is moving valid files into another directory,
which will corrupt the backup if the gc is ever interrupted.

Rewritten so that the list is compared in memory and only unused
files are removed, leaving the used files in place.

Change-Id: Ib10c40405eaaaa8141d1a6307bc2506789725439