Remove the last unsafe block from gix-revision and forbid unsafe there - #3150

AI disclosure: Claude Code, an AI agent, wrote this description, the patch and the test, and is
speaking through the b84330808 account. The commit carries a Co-Authored-By trailer for the same reason.

Motivation

The account holder asked me to look for unsafe in gitoxide's OSS-Fuzz-fuzzed parsers that can be
removed without a performance cost, as security hardening. This is
also meant for Google's Patch Rewards program, which rewards removing unsafe from Rust crates in
OSS-Fuzz projects. gix-revision was the smallest case: one unsafe block, and safe code is faster there.

Change

For rev-specs that look like git describe output, such as v1.0-12-g3bee7fb, long_describe_prefix()
computes the length of the anchor's reference name. It did this with <*const u8>::offset_from() on two
pointers into name. That was the only unsafe block in gix-revision.

• Compute the length as the distance between the address where name starts and the address where the
  last anchor token ends. This is safe Rust. If the computation were ever wrong, the bounds-checked
  name[..len] would panic. It could not cause undefined behaviour.
• Drop the next_back() call. It only located the first token for offset_from().
• Switch the crate from #![deny(unsafe_code)] to #![forbid(unsafe_code)]. Then a local
  #[allow(unsafe_code)] or #[expect(unsafe_code)] can't bring unsafe back.
• Extend full_format_parses_hash_portion_as_prefix with foo--bar-12-g3bee7fb, an anchor name with an
  empty token. The new case passes before and after the change.

Verification (by the agent, on Windows, x86_64-pc-windows-gnu, Rust 1.99.1)

• cargo test -p gix-revision --features sha1: 116 passed.
• cargo clippy -p gix-revision --all-targets --features sha1 --no-deps -- -D warnings: no findings.
• cargo +stable fmt -p gix-revision -- --check and git diff --check: clean.
• Miri (nightly 2026-10-23, interpreting aarch64-unknown-linux-gnu because faster-hex runs cpuid on
  x86): cargo +nightly miri test --target aarch64-unknown-linux-gnu -p gix-revision --features sha1 --test revision -- spec::parse: 94 passed, no undefined behaviour reported.
• A copy of the old and new function bodies, outside the crate, returned the same result for
  2M pseudo-random inputs and 1M inputs shaped like <prefix>-<digits>-g<hex><suffix>.
• In a release-mode microbenchmark of those copies (3 inputs, 15 samples of 10M calls, six rounds),
  the median was 33.7–39.0 ns before and 28.2–32.2 ns after.