librustc: Make all external functions unsafe. r=tjc