Make the safe interface a little safer.

Since FT_Load_Char destructively updates the Face's glyph slot,
we need to ensure that no one is holding a reference to that
slot when FT_Load_Char is called. In particular, that means we
shouldn't ever return an actual reference to the glyph slot.

To be honest, I'm not sure what's an idiomatic way to do something
like this (I'm new to rust), and I'm not even comfortable enough with
the borrow checker to be sure that this is correct...