Image rework: part 1 (soundness)

[cyrgani]

Part of #748.

This PR mitigates the unsoundness caused by the Image fields being public and adds new safe methods for immutable access and unsafe methods for mutable access. The second commit changes all usages of these fields within macroquad itself to the new methods.

The reason for this unsoundness is that Image::get_image_data relies on the invariant that width * height == bytes.len() to efficiently convert the image bytes into a color slice.

Fixes #634. Fixes #746.

New methods

• Image::from_parts: method for creating an image from width, height and bytes while checking if the amount of bytes is correct
• Image::bytes, Image::bytes_mut: returns an immutable / mutable slice of all bytes in the image
• Image::width_mut, Image::height_mut, Image::bytes_vec_mut: unsafe methods that return a mutable reference to the respective field, allowing for unchecked manipulation (mostly exist to support migration of strange usecases)

Other non-breaking changes

• Accessing any of the Image fields directly gives a deprecation warning and suggests using the methods instead.

[fwolfst]

Edit I see that my comment belongs does not belong to the "soundness" PR, but no other PR has been split off #748 yet.

How about adding a convenience method contains(x,y) or a maybe_set_pixel(...) method? @not-fl3 I find myself often checking whether I can set a pixel before doing so. I don't know the philosophy behind the library, maybe also a dimensions_as_rect() -> Rect / rect() makes sense (which would make the check on users side easier). I am happy to provide patches (beginner Rust level).