Panics across FFI boundaries cause undefined behavior in current Rust.
The aggregator functions are callbacks invoked from C (libsqlite).
To safe-guard against panics, std::panic::catch_unwind() is used. On
panic the functions now return with an error result indicating the
unexpected panic occurred.

std::panic::catch_unwind() requires types to implement
std::panic::UnwindSafe, a marker trait indicating that care must be
taken since panics introduce control-flow that is not very visible.
Refer to https://doc.rust-lang.org/std/panic/trait.UnwindSafe.html for a
more detailed explanation.
For SqliteAggregatorFunction::step() we must use
std::panic::AssertUnwindSafe, since &mut references are never considered
UnwindSafe, and the requirement to ensure unwind-safety is documented on
the method.
Of note is that in safe Rust, even if the method is not unwind-safe
the language still guarantees memory-safety. The marker trait is mainly
to prevent logic bugs.

This encompasses the pattern of eprintln!() + std::process::abort() and
adds a request to open an issue if the message is observed.

This is essentially the same treatment that custom aggregate functions
got in ee2f792.

…ation