Remove & -> &mut transmutation from libarena

Changes both `Arena` and `TypedArena` to contain an inner struct wrapped in a `Unsafe`, and change field access to go through those instead of transmuting `&self` to `&mut self`.

Part of #13933
Ah, good catch with the comment, I believe that's addressing whether the `T` is fully created or not (i.e. whether to run the destructor), while the problem here is an implementation detail of `&mut`s aliasing.

`RefCell` would be a way to fix this, but it does change semantics somewhat: you can no longer allocate inside an arena recursively. I'm not really sure what the appropriate path is here.