# Breaking changes

- Adds a lifetime to `BitmapData`, so it is no longer easy to store in
  persistent structs. `BitmapData` is not allowed to outlive the
  `Bitmap` that it came from.
- Makes all `BitmapData` fields private so they cannot be changed by
  callers. This is a safety invariant for accessing the underlying
  pixel and mask buffers.

 # New features

- `BitmapData::pixels()` and `BitmapData::mask()` provides access to the
  underlying pixel and mask data as byte slices.
- `BitmapData` has getter methods for its fields.
- Adds `Bitmap::get_data_mut()` to gain mutable access to the pixel and
  mask data through `BitmapDataMut`.
- `BitmapData::to_view()` and `BitmapDataMut::to_view()` are available to
  create a view of the `BitmapData` or `BitmapDataMut` that is not tied
  to the lifetime of the `Bitmap` that owns the data. `BitmapDataView`
  relinquishes access to the pixel and mask data so that it can be easily
  persisted and outlive the `Bitmap`.

 # Oddities

- `BitmapInner` has a number of public methods, but this type is never
  made accessible publically. These methods should either be made private
  or `pub(crate)`. Also, `BitmapInner` supports more methods than the
  public `Bitmap` type.
- `Bitmap::get_data_mut()` technically does not need an exclusive
  reference to `Self`, since we can rely on `borrow_mut()` panicking at
  runtime when attempting to acquire two `BitmapDataMut`s from the same
  `Bitmap`. But it is a better user experience to enforce the invariant
  at compile time.
- `BitmapDataMut` cannot exist more than once for the same `Bitmap`, as
  mentioned above. This would cause UB by allowing mutable aliasing by
  e.g. holding two references from `a.pixels_mut()` and `b.pixels_mut()`.
  These references will point to the same location in memory.

A full analysis is provided in a PR comment. The TLDR is:

- Methods with interior mutability have been changed to take exclusive
  borrows.
- `BitmapData` and `BitmapDataMut` now keep the `RefCell` borrows alive
  so that mutating cloned bitmaps will panic at runtime if the borrow is
  still held.