Store StreamWrapper::inner as a raw pointer

[icmccorm]

Fixes #392.

Storing and accessing StreamWrapper as a raw pointer fixes a tree borrows violation and removes the need for implementations of Deref and DerefMut.

[Byron]

Thanks a lot for your help!

Since this code deals with unsafe a lot, reviewing it isn't easy and I can imagine that my requests might be tedious. If so, writing down the invariants on the inner field would already help and I might be able to take it from there.

Please note that generally it would be great to have a safety block above each unsafe, but maybe it isn't particularly common in ffi code either. I am definitely open to pushback if my requests are unreasonable, but would hope for a compromise that would help me to have a better feeling about the unsafe usage, other than "it worked before, it should still work, right?".

Please note that this review is my attempt to treat unsafe a little bit like it was treated here, but it is apprentice-level at best 😅.

[icmccorm]

I'll follow up with better documentation—thanks for pointing me in the right direction!

Since this code deals with unsafe a lot, reviewing it isn't easy

My decision to remove Deref and DerefMut introduced unsafe everywhere that inner needs to be accessed, but the invariants related to inner only apply in certain situations. It can be unsound to mutably borrow inner, pass that borrow as a pointer into a foreign call, and then use the same borrow again, since it may have become invalid during the foreign call. Because of this, I decided it would be best to make accessing inner unsafe in any situation instead of providing implementations of Deref and DerefMut that are not always sound. I'm thinking of adding the following note everywhere that inner is borrowed.

/// SAFETY: The field `StreamWrapper::inner` is a pointer to a cyclic structure, so any mutable 
/// borrows against it can become invalidated by foreign function calls that mutate this 
/// structure. This borrow is safe, since it is not used after the call returns. 

Actually, now that I'm thinking of it, it might be sound to leave the implementation of Deref, but require unsafe for mutable borrows. I'll test that out and follow up with my next changes.

[icmccorm]

This should be ready to go, unless you'd like any other changes to documentation. I think Deref has the same potential soundness issues as DerefMut under Tree Borrows, so it's best to remove both traits.

[Byron]

Thanks a lot for your perseverance, it's much appreciated.

Everything looks good to me, but I am asking for another review just to be even more sure.

If it doesn't happen within a week, maybe you could ping me here so this PR gets merged anyway, after all it does seem to fix a soundness issue.

[Nilstrieb]

The change looks good to me. Bit of a shame to need all of these unsafe blocks when really the unsafety should be asserted in exactly one place^^, but unfortunately Rust doesn't provide any mechanism to do that :(

[Byron]

Thanks @Nilstrieb for the additional review, and thanks again to @icmccorm for your contribution!