Drive Tool improvements

Currently the tool spends a lot of time and multiple batches of updates that just respond with a 404 as the permission was already removed from a parent folder (aka inherited permissions). Processing of the file/permissions result should be able to identify these and avoid the need to remove them.

It is possible to limit the files().list() API operation by mimeType to folders - https://developers.google.com/drive/api/guides/ref-search-terms.

Suggested flow:

1. scan for all folders
2. if any:
   1. save recovery doc
   2. remove folder permissions
3. scan for all files
4. if any:
   1. save/update recovery doc
   2. remove file permission
5. update scan result and remove "scan" action, as appropriate

We are also going to have the potential for multiple scan recovery documents for a person if the process drops out midway. So the recovery action should attempt to merge all existing recovery docs to get a complete picture (may be a separate issue).

We also need to consider a (nightly?) process to clear recovery docs of (not recently) deleted accounts (starts in Sept) or accounts that have been unsuspended.