Rework API for better safety

Split State into 3 types: State, ExternState, and RawState. State is
only meant for using for new states, where errors will panic. Extern
functions and pcalls use ExternState instead, which marks all
error-throwing functions as unsafe. All the _unchecked methods are now
methods on RawState instead.
Add lua_extern! macro