Prevent panics statically

Issues like #200 demonstrate that the compiler is sometimes not smart enough to optimize out panics that we can prove statically won't happen. It would be good if we could:
- Refactor to only use operations which don't include panicking in their call graph
- Validate this in CI

See also #325, #1125

## Mentoring instructions

- [ ] Easy steps
- [ ] Create a new step in [this CI job](https://github.com/google/zerocopy/blob/3bb9a54ff458e104f7eb24beda7f8fb09794e1a5/.github/workflows/ci.yml#L22-L227) that runs [Red Pen](https://github.com/estebank/redpen) on zerocopy, only running the step under `if: matrix.crate == 'zerocopy' && matrix.toolchain == 'nightly'`
- [ ] Annotate as many functions as possible with `#[redpen::dont_panic]`
- [ ] Medium to hard (depending on the code): Refactor as much code as possible to remove all panics