Remove & -> &mut transmutation from libarena

Changes both `Arena` and `TypedArena` to contain an inner struct wrapped in a `Unsafe`, and change field access to go through those instead of transmuting `&self` to `&mut self`.

Part of #13933
(I know this is how it was before... it would be good to at least have a FIXME here, with a filed bug (other than #13933).)