Remove & -> &mut transmutation from libarena

Changes both `Arena` and `TypedArena` to contain an inner struct wrapped in a `Unsafe`, and change field access to go through those instead of transmuting `&self` to `&mut self`.

Part of #13933
(let me know if I should open another issue instead of discussing here)

If `ArenaInner.alloc` took the object directly, instead of the closure, then the multiple simultaneous borrows could be avoided - at the expense of doing a couple more moves/copies, which I'm not sure it's acceptable.

Also, there's [a comment in the file](https://github.com/riccieri/rust/blob/detransmute-arena/src/libarena/lib.rs#L71-L72) mentioning that "`alloc()` can be invoked recursively", but I'm not sure I understand the use case for this (and couldn't find any example of this usage in the codebase).