Soundness of autorelease pools

[madsmtm]

Autoreleasing objects using rc::autoreleasepool is unsound because we cannot ensure that the lifetime from an outer pool is not used inside an inner pool.

To help mitigate that, we provide the auto trait AutoreleaseSafe, which can be enabled with the "unstable-autoreleasesafe" feature (requires nightly, since auto traits are unstable).

Even with that, though, other libraries such as scoped-tls-hkt make assumptions that break our assumptions, see the code example provided here.

So we need some other way to make autorelease pools safe (or resort to marking them unsafe).

[madsmtm]

In df74063, I've gone with making the construction of references into the autorelease pool (like NSString::to_str and Retained::autorelease) unsafe.