New lint: potentially unwinding caller-supplied operators in `unsafe` code

What it does

If a non-unsafe generic function containing unsafe block uses an operator that is implemented by the caller (via core::ops::*) the lint warns that the operator may unwind and suggests catch_unwind or calling the method explicitly to signal the programmer thought about it.

Related: #3915
See also: https://github.com/rust-lang/rfcs/pull/3288#discussion_r922871828

Lint Name

suspicious-operators-in-unsafe

Category

suspicious

Advantage

• Forces the programmer to think about unwinds
• Signals to the reviewers "yes, I did think about unwinds" (assuming it's also justified in SAFETY comment)

Drawbacks

It's quite possible there will be a bunch of FPs. Maybe it'll have to be off by default.

Example

impl<T> Foo<T> where T: core::ops::Add {
    pub fn foo(&mut self, val: T) {
        unsafe {
            self.break_invariants();
           // oops: if this unwinds `self` ends up in invalid state
            self.a = self.b + val;
            self.restore_invariants();
        }
    }
}

Could be written as:

impl<T> Foo<T> where T: core::ops::Add {
    pub fn foo(&mut self, val: T) {
        unsafe {
            self.break_invariants();
           // prevent the caller from observing invalid state if `+` unwinds
            let result = catch_unwind(|| self.a = self.b + val);
            self.restore_invariants();
            result.unwrap();
        }
    }
}

or:

impl<T> Foo<T> where T: core::ops::Add {
    pub fn foo(&mut self, val: T) {
        unsafe {
            self.doesnt_break_invariants();
           // safe to call add because the invariants are not broken
            self.a = self.b.add(val).
            self.doesnt_affect_invariants();
        }
    }
}

Start with the issue's proposed suspicious-operators-in-unsafe behavior and the related discussion in #3915 and RFC 3288. Determine the lint's scope and false-positive policy from the 21-comment thread, then identify the Clippy lint entry point and tests to add. Done means the chosen operator cases are diagnosed consistently with the intended suggestions.