Remove DerefMut impl for RootedGuard

[gmorenz]

• We no longer construct MutableHandle via deref_mut. Doing so meant that the raw pointer in MutableHandle was only valid for as long as the mutable reference created in deref_mut would be. I.e. until the next time GC runs. This is an extension of RootedGuard<T> construction related unsoundness #564, and doesn't require a change in public API.
• It removes the deref_mut impl entirely, as it's an unsafe footgun that isn't just marked as safe, but is silently invoked.
• Creates a helper take function for RootedGuard<Option<T>>, since that was the primary use of DerefMut in servo, and is a safe thing to do.
• It adds allow_unrooted_interior to MutableHandle because the accompanying servo PR requires that crown understand MutableHandle may point to things that must be rooted over GC passes.

Accompanying servo PR: servo/servo#36158

Addresses a small part of #569.

[gmorenz]

Servo's CI is complaining because MutableHandle<T> is unrooted, and crown doesn't know about that type. So I've added another commit to this PR that adds crown::unrooted_must_root_lint::allow_unrooted_interior to MutableHandle. I believe that's correct because the purpose of this Handle is to point at something that is rooted... and thus the GC will update everything it needs to. That said I don't deeply understand what crown is checking.

[sagudev]

LGTM, but with this GC stuff it's always good to have another pair of eyes.