Make PersistentGpuBufferable a safe trait

[james7132]

Objective

Fixes #12727. All parts that PersistentGpuBuffer interact with should be 100% safe both on the CPU and the GPU: Queue::write_buffer_with zeroes out the slice being written to and when uploading to the GPU, and all slice writes are bounds checked on the CPU side.

Solution

Make PersistentGpuBufferable a safe trait. Enforce it's correct implementation via assertions. Re-enable forbid(unsafe_code) on bevy_pbr.

[james7132]

Note: the current implementations for Arc<[Meshlet]> and Arc<[MeshletBoundingSphere]> do not work correctly as described in the trait documentation on big endian systems. We may need to use encase here to ensure correctness on those platforms (as rare as they are).

[JMS55]

Encase can be slow, and I highly doubt anyone is using this feature on big-endian systems. Unless there's a way to do it without overhead, or we put it behind a conditional config, I'd rather just do an assertion that the system is little-endian or something.

[JMS55]

Theoretically, it would be nice for wgpu to provide a way to skip the zeroing, so this may change in the future if they add that. We can leave it for now though :)

[james7132]

I asked about this in the wgpu matrix chat and it seems feasible, though it may need to be exposed via &mut [MaybeUninit<u8>], which would only require unsafe inside the implementation instead of as a part of the trait itself.

[JMS55]

(Didn't mean to approve, meant to request changes)