ThreadRng::rng is unsafe

[vks]

This method must be used correctly to avoid undefined behavior. Making
it unsafe communicates this more clearly. Note that this is a private,
internal method that was and is being used soundly.

This is a followup to @RalfJung's comment in #1035.

[dhardy]

The issue is this:

let mut a = thread_rng();
let mut b = a.clone();
let ra = a.rng();
let rb = b.rng();
// both ra and rb are `&mut` to the same thing!

But at this point we might as well just take the simplest solution and inline it:

let rng = unsafe { &mut *self.rng.get() };
rng.next_u32()

[vks]

@dhardy Thanks! I pushed a commit that gets rid of ThreadRng::rng and inlines the corresponding code.

[RalfJung]

The issue is this:

Indeed, that's why the old rng should have been unsafe. Inlining also works of course. Bonus points for the safety comments. :)