wgpu_hal rules are not documented

[jimblandy]

The fundamental premise of wgpu is that wgpu_core is responsible for validation and upholding invariants, so that wgpu_hal backends can remain simple: traits in wgpu_hal have safety conditions that wgpu_core ensures.

These safety conditions are poorly documented, if at all. The documentation for an unsafe function should have a "Safety" section explaining what the function requires of its callers.

This doesn't need to be as exhaustive or as detailed as the endless VUIDs in the 3000-page Vulkan spec. We can focus on wgpu_core contributors as our audience, and worry about giving them the background and special notes they need to make sense of the hoops wgpu_core is jumping through.

This should be an incremental process, not a monster PR. Please do cite this issue in PRs, but until wgpu_hal is fully documented, please don't use "Fixes #nnn" or an equivalent.