encapsulate unsafe list-accumulators in an abstract module

This patch is still incomplete, in particular it lacks tests for most
of the functions changed, but it demonstrates the possibility to
capture all the accumulator usage under a common abstraction. The code
is provably safe (equivalent to another imperative implementation with
(type 'a mut_list = 'a list ref) and no Obj.magic at all).

The only function that gave me trouble is 'transpose', as it creates
an unbounded number of intermediate accumulators. The resulting
implementation, using continuation-passing to not break
tail-recursivity, is admittedly much less readable than the previous
one. Is it a fair cost to pay for safety by encapsulation?
Acc: specialize 'run' and 'result' to improve performances on short-list processing
BatList: a safe version of the Acc module, as a proof of soundness

I checked that using SafeAcc insteaf of Acc makes the unit-test
pass. If we assume this means they are observationally equivalent
(which is a long shot given the poor test coverage in batList.ml),
this proves soundness of the unsafe implementation -- note that some
mutability-informed compiler optimizations may still break this.