Mark certain operations as unsafe

[alamb]

Note: migrated from original JIRA: https://issues.apache.org/jira/browse/ARROW-11492

When ArrayData::new is used, we make no attempt to verify that its contents lead to sound code. In particular, for primitive arrays, the following must hold:

/// * `values.len()` is a multiple of `size_of::<T::Native>`
/// * `values.as_ptr()` is aligned with `T::Native`
/// * when `nulls` is `Some`, `nulls.len` is equal to `(ArrayData::len + 7) / 8`.
/// * `offset <= ArrayData::len`

• The first two conditions allow us to soundly transmute the u8 buffer into T::Native.
• The third condition allow us to access bits on the null bitmap up to ArrayData::len.
• The last condition avoids out of bound accesses to the data when offsets are used.

[alamb]

Done in #822