IAudioStreamPlayback::mix parameters could be made safe

`IAudioStreamPlayback::mix` is marked `unsafe` because it takes a raw pointer:

```rust
unsafe fn mix(&mut self, buffer: * mut AudioFrame, rate_scale: f32, frames: i32,) -> i32;
```

The first thing I do when implementing this function is to convert `buffer` to a slice:

```rust
unsafe fn mix(&mut self, buffer: *mut AudioFrame, rate_scale: f32, frames: i32) -> i32 {
let buffer = unsafe { std::slice::from_raw_parts_mut(buffer, frames as usize) }

// ... body of function here (can be entirely safe code)

frames
}
```

It'd be nice if godot-rust did this conversion for me before calling `mix`, which could then be made safe:

```rust
fn mix(&mut self, buffer: &mut [AudioFrame], rate_scale: f32) -> i32;
```

Godot calls `mix` from a non-main thread. I am making the assumption that Godot promises not to read or mutate `buffer` until `mix` returns. This seems a safe assumption, because it would be very silly if Godot violated this assumption, but I have not actually checked.

The fact that Godot calls `mix` from a non-main thread might also be justification on its own for keeping `mix` marked unsafe, but that's a separate issue.

Start at the IAudioStreamPlayback::mix binding and its Godot callback boundary. Check Godot's guarantees about the non-main-thread call and buffer lifetime before deciding whether the raw pointer can be exposed as a slice. Done means the API proposal is validated or rejected with the callback contract addressed.

Written by the indexing model from the issue text.