Strong exception safety in all uses of XMLFileWriter...

... Strong, meaning that the file at the specified path is created or modified
only if all write operations complete without exceptions, barring one very
unlikely possibility that a final file rename fails, but even in that case the
output is successfully written to some path.

This commit does not add throws, but changes the type thrown to a subclass of
AudacityException, so that GuardedCall will cause the user to see an error
dialog in all cases.

Duplicated logic for making temporary files and backups is now all in one
place, the class XMLWriter.

There may be more new GuardedCalls than necessary -- the catch-all for the
event loop, AudacityApp::OnExceptionInMainLoop, might be trusted instead in
some cases --  but they are sufficient.

src/AutoRecovery.h

@@ -115,8 +115,6 @@ private:
    wxMemoryOutputStream mBuffer;
    wxMemoryOutputStream mDict;
    NameMap mNames;
-   IdMap mIds;
-   IdMapArray mIdStack;
    size_t mAllocSize;
 };