Explicitly state the contracts of Stack and GuardedStack

[whitequark]

Fixes #39. Fixes #40. cc @Amanieu

[Amanieu]

As I mentioned in #39, Stack should be changed to an unsafe trait since an implementation that fails to uphold the contract could lead to memory unsafety.

The alternative is to have only GuardedStack uphold a contract. Callers of Generator::unsafe_new will then have to ensure themselves that the Stack they pass in correctly upholds the stack requirements.

[whitequark]

As I mentioned in #39, Stack should be changed to an unsafe trait since an implementation that fails to uphold the contract could lead to memory unsafety.

I don't see how this is true. You cannot use a Stack implementation without unsafe code.

[Amanieu]

I don't see how this is true. You cannot use a Stack implementation without unsafe code.

Fair enough, my point is that you should add a note in the documentation of unsafe_new saying that the caller is responsible for ensuring that the Stack he is providing properly upholds its contract.

[whitequark]

@Amanieu addressed

[edef1c]

Landed ❤️