librustc: Redo the unsafe checker and make unsafe methods not callable from safe code

r? @nikomatsakis