Mark RawBitFlags as unsafe

An implementation that lies about ALL_BITS could allow creating an
invalid value of the underlying enum type.

This is not a semver break as the trait is marked _internal.

Author: meithecatte

enumflags_derive/src/lib.rs

@@ -336,7 +336,7 @@ fn gen_enumflags(ast: &mut ItemEnum, default: Vec<Ident>) -> Result<TokenStream,
                 }
             }
 
-            impl ::enumflags2::_internal::RawBitFlags for #ident {
+            unsafe impl ::enumflags2::_internal::RawBitFlags for #ident {
                 type Numeric = #repr;
 
                 const EMPTY: Self::Numeric = 0;

src/lib.rs

@@ -188,7 +188,7 @@ pub trait BitFlag: Copy + Clone + 'static + _internal::RawBitFlags {
 pub mod _internal {
     /// A trait automatically implemented by `#[bitflags]` to make the enum
     /// a valid type parameter for `BitFlags<T>`.
-    pub trait RawBitFlags: Copy + Clone + 'static {
+    pub unsafe trait RawBitFlags: Copy + Clone + 'static {
         /// The underlying integer type.
         type Numeric: BitFlagNum;