Temporally safe by default

[Richard Andrew Cattermole (Rikki)]

As part of type state analysis work, I've been thinking about 
whether would we want to keep old ``@safe`` available for new 
editions to use.
I suspect that the answer is yes.
Not everyone wants to use DIP1000 or temporal safety.

So what I am thinking is also an answer to ``@safe`` by default.

Introduce a new level to SafeD, ``@tsafe``, for temporarily safe.

Move to disable DIP1000 in ``@safe``.
Treat it as ``@trusted + @somelints`` instead.

This also answers another question, how do you pass around old 
``@safe`` in new editions.

The default for all functions with bodies would be ``@tsafe``, if 
you see any of these four attributes, it indicates review is 
required.