librustc: Require lifetimes within the types of values with destructors

to have strictly greater lifetime than the values themselves.

Additionally, remove `#[unsafe_destructor]` in favor of these new
restrictions.

This broke a fair amount of code that had to do with `RefCell`s. We will
probably need to do some work to improve the resulting ergonomics. Most
code that broke looked like:

    match foo.bar.borrow().baz { ... }
    use_foo(&mut foo);

Change this code to:

    {
        let bar = foo.bar.borrow();
        match bar.baz { ... }
    }
    use_foo(&mut foo);

This fixes an important memory safety hole relating to destructors,
represented by issue #8861.

[breaking-change]

r? @nikomatsakis 

If you want I can talk about the followups to improve ergonomics of RefCell that I want to do, but this is the BC change.
I'm not sure that one is needed, let me check.