Add a --auto-teardown complementary flag --save-on-failure

[mpdehaan]

--auto-teardown will remove the instance if successfully baked and only works with --bake.

We should add a flag --teardown-requires-success which only tears down the baking machine if it was successful, for debugging (which would also be used with the above flag).

Or maybe rename the flags to make this more clear, or give the flag a string mode, like --teardown-mode=on-success|on-failure|always or something