ExactSizeIterator should be an unsafe trait

[theemathas]

I think that ExactSizeIterator should be an unsafe trait, so that its invariant can be relied upon by unsafe code.
See also #956 and http://internals.rust-lang.org/t/the-trusted-iterator-length-problem/1302

[huonw]

FWIW, ExactSizeIterator doesn't help that much with size_hint (covered by the linked internals thread), since we want the guarantees to apply when a type is used as a plain Iterator generic.

[nikomatsakis]

Closing in favor of the more general #1051.