RFC: use a wrapper for C-API return values to avoid missing DECREFs

Since we're using Rust here, couldn't we make the raw ffi API functions a little safer by having a transparent wrapper type for new reference return values of type *mut PyObject that can't be dropped implicitly, but has methods to be:

• converted to a PyO3 owned object (Py<PyX> or &PyX)
• dropped with a (x)decref method
• or explicitly unwrapped with a "trust me" method for special cases

Admittedly, most return values are already directly converted to PyO3 objects, so the gain is small, especially since the work to convert everything now is tedious, and it should to be done all in one release since it's a breaking change.

(I don't know off the top of my head how to make a type not-implicitly-droppable, but there must be a way - in the worst case there will be a dtolnay crate...)

Start by reviewing the raw FFI API functions that return new references and the existing conversions into PyO3-owned objects. Done would require an agreed wrapper design covering conversion, explicit decref handling, and special-case unwrapping, followed by a coordinated breaking-change implementation.