Eliminate most uses of 'unsafe' in bytesbuf

[geeknoid]

As of this writing, the bytesbuf crate contains 170 utterances of the word 'unsafe'. This is an extreme liability. We need to find ways to dramatically reduce the incidence of unsafe code, even if it hurts performance.

[geeknoid]

I'm suggesting that extremely liberal use of unsafe operations in our code means that we are losing the inherent correctness and safety benefits that Rust gives us. It's not practical for us to ensure the correctness of all this unsafe code at scale. Correctness/security/reliability should always trump performance. When you're going somewhere, a race car that occasionally blows up on you isn't as useful as a sedan which doesn't.

What I would like to see is introducing abstractions which encapsulate unsafety into a smaller number of constructs. Those constructs can then be hardened independently and used broadly. The small frequent pervasive uses of unsafe is what I want to eliminate. It's definitely not about having no unsafe code at all, it's about minimizing unsafe and spending energy towards that goal.