Remove & -> &mut transmutation from libarena

Changes both `Arena` and `TypedArena` to contain an inner struct wrapped in a `Unsafe`, and change field access to go through those instead of transmuting `&self` to `&mut self`.

Part of #13933
I agree with huon that `RefCell` and/or `Cell` should be used here where appropriate instead of `Unsafe`. It looks like there's no need for an active borrow to be in scope when `op` is invoked, so you can preserve recursive allocation.