Improve use of unsafe and fix clippy complaints.

This modifies our use of `unsafe` to prefer unsafe blocks to
fully unsafe function declarations, to make it easier to see what
operations are actually unsafe within a function, and then adds
safety documentation as appropriate.