The `Store::epoch_deadline_callback` is too powerful

Currently `Store::epoch_deadline_callback` provides the ability to run a custom embedder-defined hook whenever an epoch change is detected by guest code executing. This callback is yielded a `StoreContextMut` which enables full access to pretty much everything in the store, including executing/mutating wasm. This is, as we've now realized, too poweful of a capability. Stemming from discussions on https://github.com/bytecodealliance/wasmtime/issues/11869 it is a semantic specification violation for any guest-visible state in the store to get mutated between wasm instructions. This means that if the embedder were to call into wasm, mutate a global, mutate memory, mutate tables, etc, this is all in violation of wasm semantics. This mutation has additionally been a contributing factor in [security vulnerabilities](https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-2hw9-mc66-jc2q) in the past.

The current thinking is that we may want to replace the `StoreContextMut` argument with a custom type that gives access to `&mut T` and gives access to `StoreContext` (implements `AsContext`). This would continue to allow the embedder to inspect/mutate their own state, but would disallow embedders from mutating anything within the store.

Start with Store::epoch_deadline_callback and read the linked issue #11869 plus the referenced security advisory for the semantic and security constraints. Trace how the callback receives StoreContextMut and determine the API surface needed for embedder state and read-only store context. Done means the callback can access &mut T and StoreContext while no longer mutating or executing wasm through the store.

Written by the indexing model from the issue text.