Better newtype invariant handling

Right now several newtypes that enforce invariants like NonZero and Odd (or should, see #1127 for UintRef) are marked as pub(crate) and constructed outside the modules they're defined in. This has lead to bugs where the invariants aren't being respected. We also use typecasting in several places, sometimes to promote a reference to a type to a newtype wrapper.

I think it might make sense to remove the pub(crate) from such types and try to use a standard internal protocol for them which still allows code outside the module to promote the inner type to the newtype, but in a way that invariants at least get checked by debug_assert!, something like:

pub struct NewType<T>(T);

impl<T> NewType<T> {
    pub(crate) const fn construct(inner: T) {
        Self::check_invariants(&T);
        Self(inner)
    }

    pub(crate) const fn check_invariants(inner: &T) {
        debug_assert!(...);
    }
}

(it would need more trait bounds to actually work, but hopefully you get the idea)

I think an approach like this could catch some of the bugs we've seen where invalid newtypes were being constructed (which were my fault).

Start by tracing the NonZero and Odd newtypes, their construction sites, and the UintRef context in #1127. Determine a consistent internal construction protocol that checks invariants during promotion, then verify that existing constructions no longer permit invalid values.