rustc: track whether a type reaches Unsafe.

InteriorUnsafe is sufficient for memory aliasing that ignores pointers,
but tracking whether a type semantically contains an Unsafe is
useful (for lints).
lint: add internal mutability lint.

This picks up any use of types with internal mutability (containing
`Unsafe`) in function/method calls, since these may cause things to be
modified unexpectedly.

This lint is like the "heap memory" lints, in that using internally
mutable types is perfectly valid in many instances, but it is easy to
expose the compiler's internal knowledge for the cases when someone does
wish to keep track of everything being mutated.