Support subclass safety overrides

[carterkozak]

Before this PR

Casting from an unsafe-annotated interface to a safe-annotated interface produced UNSAFE data.

After this PR

==COMMIT_MSG==
Trust type safety on cast results, based on validation that occurred when the type was created.
==COMMIT_MSG==

Possible downsides?

The behavior this allows breaks several of our assumptions, and may cause issues elsewhere.

However there are cases where this is reasonable that don't break any assumptions, for instance:

void arbitraryObjectConsumer(@Unsafe Object input) {
    if (input instanceof SafeType) {
        // this is absolutely safe, the inputs to `arbitraryObjectConsumer` are just known
        // to allow unsafe values, they aren't required to be unsafe. All values of a safe type
        // MUST be safe.
        SafeType safe = (SafeType) input;
    }
}

[changelog-app]

Generate changelog in changelog/@unreleased

Type

• Feature
• Improvement
• Fix
• Break
• Deprecation
• Manual task
• Migration

Description

Trust type safety on cast results, based on validation that occurred when the type was created.

Check the box to generate changelog(s)

• Generate changelog entry

[svc-autorelease]

Released 4.141.0