Allow (unsafe) access to the UnsafeCell inside RefCell

[kmcallister]

This would be useful in cases where we mostly want to enforce RefCell guarantees but need to break the rules in one place. (e.g. the Servo interface to html5ever which needs to GC-trace a mutably-borrowed parser)

[jdm]

Similarly, this would be useful for RAII classes that need to be fail-proof in the face of task failure while there are outstanding RefCell borrows.

[sfackler]

@jdm I don't think that case should be an issue; the Ref/RefMut destructors have to run before their RefCell's. They don't right now in some cases due to some unsoundness problems but that will be fixed: #8861.

[Ms2ger]

Same for Cell, please, for https://github.com/servo/servo/blob/1690a40bf4de9183d4e840f0654785a4d4a4e240/components/script/dom/bindings/utils.rs#L454-461.

[kmcallister]

Does the accessor itself need to be unsafe? I don't think so, because the relevant UnsafeCell ops are unsafe and we're only handing out shared references to it.