Make iterators safe

This binds iterator lifetime to the lifetime of the DB,
to make sure they don't outlive it.

Previously, it was possible to keep them around, leading
to an error when accessing the underlying pointer.