Two Rust borrow checker soundness bugs let unsafe-free code compile

Two soundness bugs in Rust's borrow checker, open since 2013 and 2014, allow code that violates aliasing rules to compile without unsafe blocks. The issues involve two-phase borrows with raw pointer reborrows and closure capture analysis; fixes will turn such code into hard compile errors, so crates should be audited with Miri.

• First bug: reborrowing through a raw pointer loses the original &mut borrow
• Second bug: a closure captures &mut and a derived & at once
• cargo check and clippy miss both; only Miri flags them
• Once fixed, affected code will fail to compile with no deprecation window