Re: [PATCH v4 03/11] rust: xarray: add `XArrayState`

Hi Andreas,

My main worry here is cursor invalidation, i.e.: what happens if someone
mutates the tree while we have live instances of XArrayState handed out via
patch 7? For example, what if someone writes "self.state.guard.remove(...)"
inside the kernel crate itself while some user code has an OccupiedEntry?

I think this could be solved by hiding XArrayState in its own module and
exposing only a small set of checked helpers while its fields remain private so
that we carefully vet against the situation above.

Additionally we have to ensure that, in order to get the guard, one must
destroy the XArrayState, for the same reason. This is currently the case with
into_guard() IIUC, but I think it's worth to spell it out in the invariant section.

— Daniel