Mark ensure_buffer_len as unsafe
Mark ensure_buffer_len as unsafe

It is very unsafe, because it expects the caller to agree to overwrite
all bytes. This makes that a bit clearer. Just doing this does not
improve safety though.

ruuda/claxon,ruuda/claxon,ruuda/claxon