Discuss use of unsafe for create_surface

[ajtribick]

The code in the State::new section of the introductory tutorial includes a call to the unsafe create_surface method. I think it would be useful to include a discussion of what is required for this call to be valid and why the usage shown meets these requirements, preferably also with a comment in the source code at that line.

[ajtribick]

Reading up on the requirements of create_surface, I suspect that the implementation of State::new() as written should itself be marked as unsafe because it doesn't ensure that the lifetime requirement of the surface is met. I think this can be fixed by moving the Window into the last field of the State struct (last so it gets dropped last, ensuring it outlives the created Surface).

The "will panic if not called on the main thread" behavior with Metal doesn't sound like a memory unsafety issue as described, so maybe that's not relevant for providing a safe encapsulation of the unsafe call.

[sotrh]

Should be fixed in the current version