Drop-safe futures

[jadamcrain]

1. Future-interfaces are now required to implement an error type. We didn't have a use case anyway for futures with no error.
2. The raw C interface now gets wrapped in a Promise type that ensures:
   A) The promise can only be completed once
   B) Drop is called with a specified error variant if promise is not completed by user code