Implement `unsafe trait` and `unsafe impl` from the OIBIT RFC

This PR allows declaring traits and impls as `unsafe`. An `unsafe` trait requires an `unsafe` impl. An `unsafe` impl does not permit unsafe code within its interior (unless that code is contained within an unsafe block or unsafe fn, as normal). The commits are standalone.

r? @alexcrichton 
cc #13231
Shouldn't the `unsafe` go in the middle? This looks like it'll print `unsafe pub trait` instead of `pub unsafe trait`.