Remove final panics from stm32xx-sys on h7 and keep it that way

[cbiffle]

Clients generally assume that sys won't panic. Until recently there's been nothing to ensure that.

This commit rearranges sys a bit and disables its ability to generate panics at link time, using the userlib/no-panic feature. This works on our current pinned toolchain, but also on 1.79-ish current nightly, so it appears not to be super fragile.

[hawkw]

This is great! I had a couple small suggestions, but no blockers. Let me know what you think?

[hawkw]

What's the motivation for making this a task feature, rather than just always enabling it? It seems a bit awkward to have to enable no-panic in the app.tomls, when the sys task will never panic, and this only controls the elimination of the panicking code. Since the task is built independently of other tasks, we don't need to worry about e.g. feature unification enabling no-panic for everyone, so I'd kind of prefer for the app.toml author to not have to think about this at all.

I'm open to being convinced otherwise about this, though, if you think there's a real use-case for not enabling no-panic

[cbiffle]

The sys task may never panic, but the compiler is only known to reliably remove all of the panics on some of our ARMv7-M builds. I haven't tested it at all on v6-M. So for now, it's conditional.

Definitely interested in forcing it on later once we've convinced ourselves it won't be annoying.