Introduce a safe and unsafe mode

[raganhan]

Some callback interactions with the reader today are potentially dangerous, for example:

• calling reader.next() without seeking back on the input stream
• stepping in and stepping out when you have nested search paths, e.g. (foo) and (foo bar), without seeking back on the input stream

Seeking back is not trivial and in some cases impossible. Those operations won't cause the path extractor to fail but to misbehave surprising users

To avoid this we can introduce two modes:

• unsafe: todays implementation where the callback is simply stated and left to the user to respect it
• safe: where we provide a decorated reader that blocks potentially harmful operations. This decorator should be intelligent enough to only forbid stepping into containers when there are nested search paths