refactor: rewrite RwLock guards around RAII access tokens

[tisonkun]

Summary

Rewrite RwLock's eight guard types around private RAII access tokens. Guards now move their access token when projecting data or downgrading, eliminating ManuallyDrop and raw Arc extraction. Preserve the public API, semaphore-based FIFO scheduling, and guard sizes.

Apply ASF source headers to the substantially rewritten files while retaining Tokio copyright, MIT attribution, and pinned upstream mappings. Update LICENSE with the concrete implementation changes and remove the RwLock exemptions from the header checker. Rewrite the documentation around acquisition, projection, and owned lifetimes.

Design Notes

Read and write tokens own the obligation to release permits. Their owners are borrowed locks, borrowed semaphores for projections, or owned Arcs; token transfer uses Option::take without extra allocation or reference-count increments. Downgrade creates the read token before releasing other permits, so a panicking wake callback cannot leak the retained read access or owned lock reference. The regression reproduces on v0.7.1 and passes with this rewrite.

Validation: workspace tests on stable and Rust 1.86, cargo x check, cargo x miri, and 196 semver checks against 0.7.1 passed. Clippy, rustfmt, Taplo, typos, Hawkeye, and rustdoc passed (Taplo required running outside the macOS sandbox). Tests cover projection unwind/failure, all four downgrade forms, reader limits, queue ordering, cancellation before guard construction, and guard trait bounds. A local aarch64 layout comparison confirmed unchanged size/alignment for all eight guards with sized and unsized values.