All the FFI functions have fancy types now and use references instead
of raw pointers for arguments.

Now, a CFRef<T> value represents a refcounted value to be released on Drop,
CFShared<T> represents a shared value that can be retained to produce a new
CFRef<T> (this will be a useful distinction for mutable types, where a
bare T shouldn't be retainable to keep unique ownership).

To simplify things and avoid either having wrappers of wrappers of all
methods behind traits, I put the safe and thin methods directly on the
opaque FFI types.

Let's begin the infinite bikeshedding!