Remove needless unsafety from BTreeMap::drain_filter
Remove one piece of unsafe code in the iteration over the iterator returned by BTreeMap::drain_filter.
- Changes an explicitly unspecified part of the API: when the user-supplied predicate (or some of BTreeMap's code) panicked, and the caller tries to use the iterator again, we no longer offer the same key/value pair to the predicate again but pretend the iterator has finished. Note that Miri does not find UB in the test case added here with the unsafe code (or without).
- Makes the code a little easier on the eyes.
- Makes the code a little harder on the CPU:
```
benchcmp c0 c2 --threshold 3
name c0 ns/iter c2 ns/iter diff ns/iter diff % speedup
btree::set::clone_100_and_drain_all 2,794 2,900 106 3.79% x 0.96
btree::set::clone_100_and_drain_half 2,604 2,964 360 13.82% x 0.88
btree::set::clone_10k_and_drain_half 287,770 322,755 34,985 12.16% x 0.89
```
r? @Amanieu
fab9b1d4cd