Experiment with a single-allocation Value implementation

[dtolnay]

The sajson library has an interesting single allocation mode where it pre-allocates a buffer of size one word per byte in the input document. Justified in this blog post. Then it lays out data structures in that buffer without needing a single bounds check along the way.

Once #318 has been implemented, we can experiment with something similar. It should be possible to expose a Deserialize implementation that works like Value but performs just one allocation up front and no bounds checks.