[vm/concurrency] Refactor SafepointRwLock to ensure unlocking never causes safepoint transition.

The previous implementation of SafepointRwLock has an issue (discovered
by Slava, see bug) with the following code pattern:

    {
      SafepointReadRwLocker locker(...);
      return Foo(); // <-- Returns raw ptr.
    }

After the return expression has been evaluated to a raw pointer
the destructor might enter safepoint and cause GC, which leaves
the raw pointer unchanged (since it's not in a handle).

This CL refactors the implementation to ensure we don't perform any
state transition in the destructor, therefore eliminate the
possibility of GC moving the object we return.

Issue https://github.com/dart-lang/sdk/issues/44998

TEST=Relying on existing SafepointRwLock.

Change-Id: Ib7a62b36838edd4b39ad67a8c58f048aa05aa144
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/185062
Commit-Queue: Martin Kustermann <kustermann@google.com>
Reviewed-by: Alexander Aprelev <aam@google.com>
Reviewed-by: Vyacheslav Egorov <vegorov@google.com>