librustc: Require lifetimes within the types of values with destructors

to have strictly greater lifetime than the values themselves.

Additionally, remove `#[unsafe_destructor]` in favor of these new
restrictions.

This broke a fair amount of code that had to do with `RefCell`s. We will
probably need to do some work to improve the resulting ergonomics. Most
code that broke looked like:

    match foo.bar.borrow().baz { ... }
    use_foo(&mut foo);

Change this code to:

    {
        let bar = foo.bar.borrow();
        match bar.baz { ... }
    }
    use_foo(&mut foo);

This fixes an important memory safety hole relating to destructors,
represented by issue #8861.

[breaking-change]

r? @nikomatsakis 

If you want I can talk about the followups to improve ergonomics of RefCell that I want to do, but this is the BC change.
So I don't quite understand why all these indirections are needed, actually. It could be I'm just not thinking through the ramifications of the rule, but it seems like the rvalue with a dtor (the `RefMut`, presumably) is live for the enclosing statement. Therefore, it must only be able to reach lifetime points that outlive the statement (i.e., are live for the enclosing block). I feel like this condition should be met. If you are getting errors, it seems likely to be an error in inference or somewhere else.