Transition to @safe by default

[Richard (Rikki) Andrew Cattermole]

I've changed my mind on disallowing ``@unknownsafety`` on functions.

If we allow it, extend this DIP over to ``@nogc`` and ``pure`` we could 
get a limited form of contract invalidation for ``opApply``.

``nothrow`` of course is covered by needing to introduce the throws set 
for value type exceptions.

So I'm liking this direction.