Potentially @safe & pure formatting

Determine and separate `@trusted` operations in `Appender`, `formattedWrite`/`formatValue`, `parse`, and `toImpl`.

This pull request is quite big, but we need to change them all *at once*. Because (excepting Appender) formattedWrite, parse and toImpl have dependencies between each other.

`nothrow`-ness is not currently supported, because:
- `std.format.formatValue` throws `FormatException` for invalid format specifiers.
- `std.conv.to` throws `ConvException` when conversion fails.

-----
Requires compiler fixes:

- [#2150](https://github.com/D-Programming-Language/dmd/pull/2150) [REG2.063] Issue 10299 - ICE with getting address of template
- [#2149](https://github.com/D-Programming-Language/dmd/pull/2149) Issue 10296 - Nested template function call and purity inference bug
- <del>[#2145](https://github.com/D-Programming-Language/dmd/pull/2145) Issue 10289 - compiler should infer nothrow even if Error is thrown</del> (merged)
- [#2143](https://github.com/D-Programming-Language/dmd/pull/2143) Issue 10288 - Direct lambda call and purity inference bug
- <del>[#2142](https://github.com/D-Programming-Language/dmd/pull/2142) Issue 7848 - pure and nothrow ignored on unittest blocks</del> (merged)
- <del>[#2141](https://github.com/D-Programming-Language/dmd/pull/2141) Issue 8651 - Slice op Slice throws exceptions (not errors), and nothrow</del> (merged)

Requires compiler fix:
- <del>[#512](https://github.com/D-Programming-Language/druntime/pull/512) Change the Exception/Error constructors to @safe pure nothrow</del> (merged)
- <del>[#515](https://github.com/D-Programming-Language/druntime/pull/515) Change memcpy, memmove, and memset to pure</del> (merged)