Parse unsafe modules and unsafe extern blocks

[dtolnay]

Requires rust-lang/rust#75857.

For now the keywords are parsed but ignored, but the idea is that in a future release we would rely on unsafe extern for the syntactic safety claim that unsafe on the function declarations within have been accurately prescribed.

#[cxx::bridge]
mod ffi {
    unsafe extern "C++" {
        fn f();  // safe to call, unsafe to declare
        unsafe fn g();  // unsafe to call, safe to declare
    }
}

We would enforce that the extern block is unsafe unless all functions inside it have been declared unsafe, in which case the extern block is not making a safety claim that these functions are safe to call.