Rewrite Sodium::Buffer to use an FFI::Pointer rather than a String

This avoids nastiness like copying garbage collectors from copying our memory
all over, forcing us to lose control of it. More importantly, we fix a nasty
bug related to garbage collection. If you retain a pointer to a
Sodium::Buffer's bytes but not the buffer itself, the buffer can be garbage
collected at any time (clearing your bytes).

The new implementation removes Sodium::Buffer#to_str and replaces it with
Sodium::Buffer#to_ptr and Sodium::Buffer#to_s. to_ptr gives you the actual
memory pointer to do with as you like. to_s gives you the actual String
contents, at which point guarantees are no longer made as to our ability to
clear the memory pointed to by the string. It is the caller's responsibility
never to call to_s on sensitive data unless absolutely necessary.