Combine API to increase safety when accumulator is mutated

Combine docs for e.g. `mergeAccumulators` say

"only the first accumulator may be modified and returned for efficiency; the other accumulators should not be mutated, because they may be shared with other code and mutating them could lead to incorrect results or data corruption."

This is fine, but the API is odd: `AccumT mergeAccumulators(Iterable accumulators)` implies that all accumulators are treated equally.

It has been suggested to create a new one more like `AccumT mergeAccumulators(AccumT mutable, Iterable immutableAccums)`

Imported from Jira [BEAM-10326](https://issues.apache.org/jira/browse/BEAM-10326). Original Jira may contain additional context.
Reported by: kenn.