Audit Py<T> methods for GIL safety

[davidhewitt]

As part of the invariant that Py<T>'s data can only be accessed when the GIL is locked, all the member functions should either acquire the GIL or take a GIL token as an argument. Py::get_refcnt and several of the unsafe functions doesn't appear to lock the GIL internally.

Note that it is Undefined Behavior to read the reference count using a plain memory read (what ffi::Py_REFCNT does) while a different thread is concurrently modifying it, making get_refcnt have safety issues.

Originally posted by @programmerjake in #948 (comment)

Proposed actions to resolve this:

• Add Python token as an argument to all safe function that require the GIL.
• Add # Safety documentation to all unsafe functions that require the GIL. (Or alternatively add Python token argument to them too.)

[programmerjake]

There are similar issues for PyObject::get_refcnt and probably other member functions.