Implement `unsafe trait` and `unsafe impl` from the OIBIT RFC

This PR allows declaring traits and impls as `unsafe`. An `unsafe` trait requires an `unsafe` impl. An `unsafe` impl does not permit unsafe code within its interior (unless that code is contained within an unsafe block or unsafe fn, as normal). The commits are standalone.

r? @alexcrichton 
cc #13231