Refactor some descriptor set/allocation things

[Rua]

Changelog:

### Breaking changes
Changes to descriptor sets:
- `DescriptorPool::allocate_descriptor_sets` is now validated, and returns `DescriptorPoolAlloc` objects.
- `DescriptorSetAllocator::allocate` returns `Validated<VulkanError>` as its error type.
- `UnsafeDescriptorSet::update` is now partially validated, and takes slices instead of iterators.
- `UnsafeDescriptorSet` now owns its allocation.

What started off as a simple doc fix got a bit bigger...

This PR makes descriptor set allocation behave a little more like command buffer allocation:

• UnsafeDescriptorSet now holds onto the allocation, just like UnsafeCommandBuffer.
• Descriptor pools allocate DescriptorPoolAlloc objects, in the same way that command pools allocate CommandPoolAlloc objects. Both of these types hold information that was passed to the allocate_* function (for descriptor sets, that means the layout and variable count).
• UnsafeDescriptorSet now validates what it can, but without tracking any state or holding onto any resources, just like UnsafeCommandBufferBuilder.

The DescriptorSetInner type ended up superfluous and was removed altogether.