RawTable::insert_no_grow needs safety checks, or should be unsafe

[cuviper]

This program segfaults:

use hashbrown::raw::RawTable;
fn main() {
    let mut table = RawTable::new();
    loop {
        table.insert_no_grow(0, 0);
    }
}

If I change this to have some initial capacity, then in debug mode it panics decrementing growth_left:

thread 'main' panicked at 'attempt to subtract with overflow', /home/jistone/.cargo/registry/src/jackfan.us.kg-1ecc6299db9ec823/hashbrown-0.11.2/src/raw/mod.rs:882:13

In release mode that loops forever. I added debug prints for len/capacity, and that gets up to 16/14 before hanging entirely.

I suppose panic/infinite-loop is somewhat acceptable from a safety perspective, as long as we're sure to do one of those without corrupting memory, but the empty case is definitely a problem. Maybe we should assert the same condition that the regular insert uses when it decides to resize? We could even use/mimic try_insert_no_grow and then panic on error.

[Amanieu]

The main use case for insert_no_grow is to support the Entry type in libstd which isn't parameterized by S. This means that libstd's entry must reserve space when the Entry is created so that it can later call insert_no_grow without a hasher.

Since it is barely used outside hashbrown, I'm happy to switch this function to being unsafe.

[cuviper]

We do use it in indexmap too, but only when bulk-inserting items where we're sure the capacity is sufficient. I could live with that being unsafe.