Make internal OsString::truncate and extend_from_slice unsafe

Communicate the safety invariants of these methods with `unsafe fn`
rather than privacy.

library/std/src/path.rs

@@ -2759,7 +2759,8 @@ impl Path {
         };
 
         let mut new_path = PathBuf::with_capacity(new_capacity);
-        new_path.inner.extend_from_slice(slice_to_copy);
+        // SAFETY: The path is empty, so cannot have surrogate halves.
+        unsafe { new_path.inner.extend_from_slice_unchecked(slice_to_copy) };
         new_path.set_extension(extension);
         new_path
     }