Service dependencies aren't checked at destruction time

If service A uses another service B and the service B is destroyed, the dependency to service A sn't checked or removed when the force option is used. This results in a stale pointer being left in the upper level service which will result in a crash.

Similarly, if a filter or another service has a parameter of a type that points to a target, the dependency isn't tracked. One of these is the targets parameter in the tee filter which points to a service or a server. If either of those is destroyed, the filter dependency is left unmodified.

To prevent these problems, the force option should only destroy the object if it can safely unlink the object from the others. It should not try to cascade the destruction and it should fail if it finds a hard dependency between the objects. Without the force mode the normal dependency checks will prevent the destruction once they are fixed.