seal Buf trait and make dst() method unsafe for soundness and safety

[biryukovmaxim]

Problem

The Buf trait was unsound. It allowed transmuting &mut [u8] to &mut [MaybeUninit<u8>] through a safe interface, which could be exploited to cause undefined behavior.

Solution

This PR makes the trait sound using the sealed trait pattern:

1. private::Sealed - Empty trait in private module, implemented only for [u8] and [MaybeUninit<u8>]
2. Buf: private::Sealed - Public trait requires the sealed trait, preventing external implementations
3. unsafe fn dst() - Method marked unsafe with documented safety requirement: callers must only write initialized bytes
4. Safety comments - Added at all call sites documenting why the invariant is upheld

Safety Guarantee

The library maintains the invariant that only fully initialized bytes are written through dst():

• encode_to_buf writes through encode_simd_* and encode_scalar, all of which write initialized bytes
• decode_to_buf writes through decode_into, which writes initialized bytes

[cfcosta]

Sorry about the delay, have been traveling for the past few weeks. I'm back now :D