Require an unsafe block to modify a string

In the rust manual, one of the definitions of unsafe behavior that the compiler
disallows is allowing non-UTF-8 byte sequences in a string, so this fixes the
compiler to actually do its job in enforcing this invariant.

Closes #8891