The pool implementation had an unsound `unsafe impl Sync` on `PoolInner`
containing `Vec<PoolPlugin>` where `PoolPlugin` was `Rc<RefCell<Plugin>>`.
This caused intermittent "RefCell already borrowed" panics in multi-threaded
usage (issue extism#891).

The problem with the original design was that it seemed to assumed external
locking (the pool's `Mutex`) would be sufficient to make `Rc<RefCell<>>` safe
to share across threads. However, there were several issues that made the
design unsound:

1. `PoolPlugin` had no `Drop` implementation to synchronize refcount
   decrements. When dropped on different threads, unsynchronized `Rc`
   refcount modifications could lead to data races.
2. The pool used `Rc::strong_count == 1` to track availability, but had no
   control over when clones were created or destroyed. Callers could clone
   and keep `PoolPlugin` instances, breaking the availability tracking.
3. The `PoolPlugin` type didn't leverage the type system to enforce safe
   usage patterns; it relied entirely on external locking that the type
   system couldn't verify.

This replaces the unsafe implementation with proper thread-safe primitives
and move semantics inspired by the deadpool crate.

Changes:

- Replace shared `Rc<RefCell<Plugin>>` with move semantics: plugins are
  moved out of a `VecDeque` when checked out and moved back on drop
- `PoolPlugin` now owns the plugin and implements `Drop` to automatically
  return it, making checkout/return atomic and type-safe.
- Add `Send` bound to `UserDataHandle::Rust` (`dyn Any` → `dyn Any + Send`).
  `UserData<T>` already had the `Send` bound, but when converted to
  `UserDataHandle::Rust` it was being removed during type erasure. This
  was necessary to make `PluginBuilder` with custom functions `Send`,
  enabling pools with custom host functions
- Replace busy-wait polling with `Condvar` for efficient waiting
- `PoolPlugin` implements `Deref`/`DerefMut` for ergonomic access
- Use `Weak` reference to pool so checked-out plugins don't keep pool alive
- Remove all `unsafe impl Send/Sync`. Soundness is now enforced by the
  type system.
- Fix `function_exists` to handle timeout gracefully instead of panicking.
- Add test for pools with captured `PluginBuilder` containing custom functions.

Breaking API changes:

- `PoolPlugin` no longer has a `.plugin()` method - it now implements
  `Deref`/`DerefMut`, so you can use it directly where you previously
  called `.plugin()`. Example: `pool.get()?.call(...)` instead of
  `pool.get()?.plugin().call(...)`
- `PoolPlugin::call()` now takes `&mut self` instead of `&self` (direct
  ownership instead of interior mutability via `RefCell`)
- `UserData` types must be `Send` (previously claimed via `unsafe impl`
  but not enforced through type erasure to `dyn Any`)

Fixes extism#891