explicitly keep the door open for some but not all subobject provenance

[RalfJung]

Miri has enforced fairly strict subobject provenance by default since ~forever, but the Reference never explicitly called this out as UB. Let's fix that. This is the conservative choice; we document this as UB now and maybe lift the UB restriction again in the future.

This PR includes two commitments that @rust-lang/opsem (and maybe @rust-lang/lang) should FCP:

• While we generally keep the door open for subobject provenance, we explicitly say that there is no subobject provenance within arrays/slices. This is based on the observation that violations of such subobject provenance are the major kind of Stacked Borrows UB that Miri finds. I'd like to make Miri stop report this as UB, and for this I'd like to be sure that indeed we don't want to make this UB.
• While we generally keep the door open for "discriminant protection", we do explicitly say that it is okay to temporarily change the discriminant of an enum via a field reference, and then change it back. This is needed to make code like this sound, which came up multiple times in questions recently (1, 2).

I proposed for opsem to FCP these two choices in:

• No subobject provenance for arrays/slices unsafe-code-guidelines#622
• Can references inside an enum transiently set an invalid enum discriminant? unsafe-code-guidelines#621

This PR should only be merged once both of those FCP completed.