Proposal: Use `Span` for `WindowsRuntimeBufferMarshal.TryGetDataUnsafe`

Summary

Replace the following methods:

namespace WindowsRuntime.InteropServices;

public static class WindowsRuntimeBufferMarshal
{
-    public static bool TryGetDataUnsafe([NotNullWhen(true)] IMemoryBufferReference? buffer, out byte* data, out uint capacity);
+    public static bool TryGetDataUnsafe([NotNullWhen(true)] IMemoryBufferReference? buffer, out Span<byte> data);
-    public static bool TryGetDataUnsafe([NotNullWhen(true)] IBuffer? buffer, out byte* data);
+    public static bool TryGetDataUnsafe([NotNullWhen(true)] IBuffer? buffer, out Span<byte> data);
}

Rationale

With the theme of unsafe evolution, the .NET runtime team is reducing the usages of raw pointers and replacing with safe equivalents like Span<T>. Span<T> and Memory<T> can hold unmanaged memory, and users who need raw pointers can use fixed or System.Runtime.CompilerServices.Unsafe to get it back.

Important Notes

It's important to decide the safeness of span-returning method under the new rule (RequiresUnsafe). Since it requires manual KeepAlive for the object, it should be considered unsafe (similar to CollectionsMarshal.AsSpan(List<T>)). Since most things under xxMarshal would be unsafe, this shouldn't be a problem.

Alternatively, returning a IMemoryOwner<byte> can achieve completely safe lifetime for the caller, but with more overhead and unnatural usage patterns.

Open Questions

Should the IBuffer case use Capacity or Length? Capacity is natural for writing and Length is natural for reading, should it be split into two overloads returning Span and ReadOnlySpan respectively?

Should the name be change to drop the Unsafe suffix to match BCL naming convention? The term "marshal" already implies unsafeness.

Start by reviewing WindowsRuntime.InteropServices.WindowsRuntimeBufferMarshal.TryGetDataUnsafe for both IMemoryBufferReference and IBuffer overloads, then read the linked unsafe-evolution proposal. Resolve the Span lifetime and safety implications, the IBuffer Capacity-versus-Length choice, and whether the Unsafe suffix should remain; done means the API design questions have a decided direction.