Avoid unsafe where safety depends on non-local values

[dhardy]

• Added a CHANGELOG.md entry

Summary

Avoid usage of unsafe in contexts where non-local memory corruption (e.g. in RAM) could invalidate a safety contract.

Motivation

This could be seen as an alternative fix to #1790, though I'd prefer to merge both PRs.

This PR could have noticeable impacts (performance, code size, panic point). If this is a significant concern we could consider alternatives (not doing this, using a feature flag, adding an explicitly-unsafe variant such as slice::ChooseUnsafe).

[newpavlov]

With any "non-local memory corruption" all bets are off, so I am not sure it's worth to guard against it.

Minimizing amount of unsafe code could be a sufficient motivation for this change, but personally I am fine with the current code as well.

[tarcieri]

I'm not sure about the memory corruption angle, but avoiding unsafe seems good to me