When is a Rust function "unsafe"?