Callbacks passed to Function::new should be UnwindSafe.

[m-hilgendorf]

This applies to other APIs that take callbacks such like mentioned in #534. This can help avoid undefined behavior when a Rust function is called from C++ and panics.

If the trait bound is too high a burden as it's a breaking change, the API implementations should use catch_unwind or mark functions that take callbacks as arguments as unsafe (which they currently are). Otherwise it should be well documented that panicking will (hopefully) crash the process when unwinding fails, whereas a normal panic would only crash a thread.