We should document what we expect from `// Safety: ..` comments. See also https://github.com/rust-lang/rust/issues/66219