Improvements to Ref<>

[snej]

• destroy() method releases the reference, equivalent to = nullptr which is otherwise disallowed. This is for cases where a non-null reference needs to be released in e.g. a close() method, but it's understood that it can't be accessed again. This allows it to be typed as Ref<>.
• isValid() returns false if the Ref has been destroyed.
• operator bool is disallowed for Ref<>, because it's conceptually not nullable, so testing it is usually a sign that you're doing unnecessary checks. If you really need to check, use isValid().

Also converted some Retaineds into Refs in the Fleece codebase, and fixed a template method in ValueSlot that didn't work with Ref.

Also fixed some new clang printf warnings.