Credit to [email protected] for figuring out how to make this design
more misuse-proof.

Implementing `TryFromBytes` for `UnsafeCell` isn't possible without
changes to `TryFromBytes`. Previously, we passed `is_bit_valid` a `Ptr`
with shared aliasing. There is no way to soundly implement
`is_bit_valid` for `UnsafeCell` with a shared-aliased pointer, as
there's no way to soundly inspect the bytes of an `UnsafeCell` when
other references may exist to the same memory. The only way to inspect
the bytes of an `UnsafeCell` in a generic context is given a mutable
reference to one. This is in principle possible from `TryFromBytes`.
Notably, `try_read_from` reads a `MaybeUninit<Self>` into its local
stack frame, and that has `UnsafeCell`s at the same byte ranges as
`Self`, so it is sound to construct a mutably-aliased `Ptr` to that
local variable. Unfortunately, `is_bit_valid` previously had no way of
reasoning about a mutably-aliased pointer.

In order to lift this restriction, we modify `is_bit_valid` to be
generic over aliasing using `A: invariant::at_least::Shared`. When `A`
is `invariant::Exclusive`, we can implement `TryFromBytes::is_bit_valid`
for `UnsafeCell`.

However, this isn't the whole story. We need to implement `TryFromBytes`
for `UnsafeCell` in the general case, even when a shared-aliased `Ptr`
is passed to `is_bit_valid`. Our first design was to define calling
`UnsafeCell::is_bit_valid` with a shared-aliased to be a panic condition
of `is_bit_valid`. Since we only call `is_bit_valid` from our own code
(`is_bit_valid` is `#[doc(hidden)]`), we can in theory simply avoid
calling `UnsafeCell::is_bit_valid` with a shared-aliased pointer.
However, that's very error-prone.

jswrenn had the idea to instead use a post-monomorphization error, which
is implemented in `Ptr::into_exclusive_or_post_monomorphization_error`.
This allows us to test *at compile time* to see whether the argument to
`UnsafeCell::is_bit_valid` is a shared or exclusive pointer, and fail
compilation in the former case.

Some readers might wonder why we couldn't use a `NoCell` bound to
enforce that `is_bit_valid` could only be called with a shared-aliased
pointer when `Self: NoCell`. We experimented with this, but it turns out
that there is some existing code that cannot be made to work with this
pattern - the type system isn't smart enough to infer bounds in some
cases.

Makes progress on #5