fix(ffi): make FFI_ArrowSchema::with_metadata unsafe and guard null private_data

[bit2swaz]

Which issue does this PR close?

• Closes with_metadata is UB on FFI-imported schemas #10679
• Closes Null pointer dereference in FFI_ArrowSchema::with_metadata when used with empty schema #10286

Rationale for this change

with_metadata reads self.private_data as a SchemaPrivateData and writes to it, here. but private_data is only a SchemaPrivateData when arrow-rs built the schema. so on any other schema this is undefined behavior, and you can trigger it from safe code two ways:

• foreign schema (with_metadata is UB on FFI-imported schemas #10679): one imported from pyarrow, C++ or java owns its own private_data, so reading it as ours is UB
• empty schema (Null pointer dereference in FFI_ArrowSchema::with_metadata when used with empty schema #10286): empty() sets private_data to null, so the read becomes Box::from_raw(null)

we cant tell these apart at runtime: the c data interface says private_data is opaque, so theres nothing to check. the fix is to have the caller promise the schema is ours, which is what #10679 landed on

What changes are included in this PR?

• with_metadata is now unsafe, with a safety doc saying the caller must pass a schema arrow-rs built. this covers the foreign case (with_metadata is UB on FFI-imported schemas #10679).
• it now returns an error on null private_data instead of reading it. this covers the empty case (Null pointer dereference in FFI_ArrowSchema::with_metadata when used with empty schema #10286).
• the two callers inside this crate (TryFrom<&Field> and TryFrom<&Schema>) now use an unsafe block. both build the schema themselves, so they meet the new rule.

Are these changes tested?

added test_with_metadata_on_empty_schema_errors: it calls empty().with_metadata(...) and checks for Err.

ran it under miri with the same -Zmiri-disable-isolation config CI uses. on the old code miri reports UB, after the fix it passes.

the foreign case has no test, you cant call an unsafe fn on a foreign schema in a passing test.

Are there any user-facing changes?

yes, this is breaking:

• FFI_ArrowSchema::with_metadata is now unsafe, so callers need an unsafe block.
• on a schema with null private_data it returns an error instead of hitting UB.

[Jefffrey]

im on similar mind to this comment from @alamb

Perhaps it would be more future proof to just set private_data for the result of FFI_ArrowSchema::empty()?

It seems like it is not unreasonable to set metadata on an empty schema, and I worry that other existing (or newly added) code paths will assume private_data is non null

• fix: guard FFI schema metadata on empty schema #10289 (review)

that or set it here if we're adding metadata to an empty schema 🤔

though we can check the other ffi structs to see how they deal with this