`Counter::next_nonzero` can have undefined behavior

Nobody has claimed this yet.

Per the documentation of [AtomicU64::fetch_add](https://doc.rust-lang.org/core/sync/atomic/struct.AtomicU64.html#method.fetch_add)

> This operation wraps around on overflow.

This means that the following function will return zero if fetch_add is called U64::MAX times which violates the safety requirements for `NonZeroU64::new_unchecked`.

```rust
/// Return the next value, as a `NonZeroU64`.
pub fn next_nonzero(&self) -> NonZeroU64 {
// safe because our initial value is 1 and can only be incremented.
unsafe { NonZeroU64::new_unchecked(self.0.fetch_add(1, Ordering::Relaxed)) }
}
```

Start at Counter::next_nonzero and review the AtomicU64::fetch_add behavior against the NonZeroU64 safety requirement. Trace the counter's initialization and overflow path; the issue is resolved when repeated increments cannot produce a zero value for NonZeroU64.

Written by the indexing model from the issue text.