Make std.file.getAttributes safe

It contains the following unsafe operations but we can verify that they can be trusted.

On Windows systems:
- use of unsafe functions `core.sys.windows.windows.GetFileAttributesW` and `std.internal.cstring.tempCstringW`

On Posix systems:
- use of `core.sys.posix.sys.stat.stat` and `std.internal.cstring.tempCstringW`
- taking address of a local variable (`statbuf`)

And I fixed the following issue on Windows systems.
- The [document of  GetFileAttributesW](http://msdn.microsoft.com/en-us/library/windows/desktop/aa364944(v=vs.85).aspx) (it is same as the document of `GetFileAttributes`) says that if `GetFileAttributesW` fails, it returns `INVALID_FILE_ATTRIBUTES` (I'm not sure it is same as `uint.max`).
  I replaced `uint.max` with `INVALID_FILE_ATTRIBUTES` and `enforce` with `cenforce`.
  
BTW, I saw a thread [Encapsulating trust](http://forum.dlang.org/thread/ltv91u$2mtc$1@digitalmars.com) in the forum. 
Should I wait for sending the requests about safe until we get a consensus about it?
Or is it OK to keep sending requests about safe (using nested functions or direct lambda calls) and to fix them to use a unified way after we get a consensus about it?

Any particular reason why `ref` was chosen instead of a pointer? Seems better to stick to the same interface as `stat`.