Rewrite for recursive safety

This commit rewrites the runtime crate to provide safety in the face
of recursive calls to the guest. The basic principle is that
`GuestMemory` is now a trait which dynamically returns the
pointer/length pair. This also has an implicit contract (hence the
`unsafe` trait) that the pointer/length pair point to a valid list of
bytes in host memory "until something is reentrant".

After this changes the various suite of `Guest*` types were rewritten.
`GuestRef` and `GuestRefMut` were both removed since they cannot safely
exist. The `GuestPtrMut` type was removed for simplicity, and the final
`GuestPtr` type subsumes `GuestString` and `GuestArray`. This means
that there's only one guest pointer type, `GuestPtr<'a, T>`, where `'a`
is the borrow into host memory, basically borrowing the `GuestMemory`
trait object itself.

Some core utilities are exposed on `GuestPtr`, but they're all 100%
safe. Unsafety is now entirely contained within a few small locations:

* Implementations of the `GuestType` for primitive types (e.g. `i8`,
  `u8`, etc) use `unsafe` to read/write memory. The `unsafe` trait of
  `GuestMemory` though should prove that they're safe.

* `GuestPtr<'_, str>` has a method which validates utf-8 contents, and
  this requires `unsafe` internally to read all the bytes. This is
  guaranteed to be safe however given the contract of `GuestMemory`.

And that's it! Everything else is a bunch of safe combinators all built
up on the various utilities provided by `GuestPtr`. The general idioms
are roughly the same as before, with various tweaks here and there. A
summary of expected idioms are:

* For small values you'd `.read()` or `.write()` very quickly. You'd
  pass around the type itself.

* For strings, you'd pass `GuestPtr<'_, str>` down to the point where
  it's actually consumed. At that moment you'd either decide to copy it
  out (a safe operation) or you'd get a raw view to the string (an
  unsafe operation) and assert that you won't call back into wasm while
  you're holding that pointer.

* Arrays are similar to strings, passing around `GuestPtr<'_, [T]>`.
  Arrays also have a `iter()` method which yields an iterator of
  `GuestPtr<'_, T>` for convenience.

Overall there's still a lot of missing documentation on the runtime
crate specifically around the safety of the `GuestMemory` trait as well
as how the utilities/methods are expected to be used. Additionally
there's utilities which aren't currently implemented which would be easy
to implement. For example there's no method to copy out a string or a
slice, although that would be pretty easy to add.

In any case I'm curious to get feedback on this approach and see what
y'all think!

crates/test/src/lib.rs

@@ -1,17 +1,14 @@
 use proptest::prelude::*;
+use std::cell::UnsafeCell;
 use wiggle_runtime::GuestMemory;
 
 #[repr(align(4096))]
 pub struct HostMemory {
-    buffer: [u8; 4096],
+    buffer: UnsafeCell<[u8; 4096]>,
 }
 impl HostMemory {
     pub fn new() -> Self {
-        HostMemory { buffer: [0; 4096] }
-    }
-
-    pub fn guest_memory<'a>(&'a mut self) -> GuestMemory<'a> {
-        GuestMemory::new(self.buffer.as_mut_ptr(), self.buffer.len() as u32)
+        HostMemory { buffer: UnsafeCell::new([0; 4096]) }
     }
 
     pub fn mem_area_strat(align: u32) -> BoxedStrategy<MemArea> {
@@ -29,6 +26,15 @@ impl HostMemory {
     }
 }
 
+unsafe impl GuestMemory for HostMemory {
+    fn base(&self) -> (*mut u8, u32) {
+        unsafe {
+            let ptr = self.buffer.get();
+            ((*ptr).as_mut_ptr(), (*ptr).len() as u32)
+        }
+    }
+}
+
 #[derive(Debug)]
 pub struct MemArea {
     pub ptr: u32,