Add opt-in unsafe generated accessors

[RejectKid]

Summary

• add BitObjectAccessMode.Unsafe as an explicit source-generator opt-in while preserving checked generation as the default
• generate unchecked raw-reference accessors for eligible Memory<byte>, Span<byte>, arrays, fixed buffers, and inline arrays
• add UnsafeBitPrimitives for the underlying unchecked operations
• retain existing checked intrinsic specializations wherever benchmarking shows they are faster
• document the required padded-buffer contract and the memory-safety/security tradeoff
• add randomized equivalence tests, all-backing-kind coverage, and paired generated-accessor benchmarks

This PR intentionally does not include the planned batch API; that will be a separate change.

Performance

AMD Ryzen 9 9900X, .NET 10.0.8, BenchmarkDotNet MediumRun. All cases allocate 0 B.

Generated Memory<byte> operation	Checked	Unsafe	Improvement
Boolean read	0.9429 ns	0.8494 ns	9.9%
Boolean write	0.8943 ns	0.8693 ns	2.8%
Misaligned 20-bit read	0.9714 ns	0.8235 ns	15.2%
Misaligned 20-bit write	1.0325 ns	0.9490 ns	8.1%

The complete 99-case benchmark suite also completed successfully using ShortRun.

Safety contract

Unsafe mode is never inferred. Callers must guarantee non-empty, stable, sufficiently padded backing storage for every generated access. Violating that contract can cause out-of-bounds access, data corruption, information disclosure, or process failure. Checked access remains the default.

Validation

• Release build: 0 warnings, 0 errors
• tests: 4,593 passed on .NET 8 and 4,593 passed on .NET 10
• randomized unsafe primitive and generated-accessor equivalence tests
• full 99-case benchmark suite: passed
• focused MediumRun benchmark comparison: passed, 0 B allocated
• NuGet pack and package validation using 1.6.0-preview.1: passed
• git diff --check: passed