Check for interior nulls in .to_c_str()

Previous dicussions about CString suggested that interior nulls should
throw an error. This was never implemented. Add this now, using a
condition (named null_byte) to allow for recovery.

Add method .to_c_str_unchecked() that skips this check.
Add ToCStr method .with_c_str()

.with_c_str() is a replacement for the old .as_c_str(), to avoid
unnecessary boilerplate.

Replace all usages of .to_c_str().with_ref() with .with_c_str().
Make CString.iter() public
Remove inappropriate .to_c_str() in C_cstr()

LLVMConstStringInContext() doesn't need a null-terminated string. It
takes a length instead. Using .to_c_str() here triggers an ICE whenever
the string literal embeds a null, as in "\x00".