alloc_error_handler can be an `unsafe fn` which is then unsoundly invoked

[RalfJung]

This code currently compiles:

#![feature(alloc_error_handler)]
#![no_std]

extern crate alloc;

#[alloc_error_handler]
unsafe fn f(_: alloc::alloc::Layout) -> ! {
    core::hint::unreachable_unchecked();
}

This is unsound if the alloc error handler ever gets invoked.

The alloc_error_handler feature is still unstable, tracking issue: #51540