Implement more complete fix for #716

[joshlf]

The fix implemented for #716 patches the soundness hole, but results in an API which doesn't properly express the type bounds for when it is sound to call Ref::into_ref, into_mut, into_slice, and into_mut_slice. We should restructure the API so that these methods fail to compile when used with unsound types (core::cell::Ref and core::cell::RefMut), but compile successfully when used with sound types. This will be a breaking change.