Robust descriptor release, safe handle access, more iterator usage

[kvark]

This is super important, has 3 parts:

• fixed and refined descriptor set allocation (now calling free on failure)
• added a check to Handle be valid on any access, this catches the Dota bug in all configurations and is hugely important for us to avoid undefined behavior in the future
• removes a few Vec::collect() occurrences in favor of iterators

[kvark]

@msiglreith ping

[bors[bot]]

Build succeeded

• continuous-integration/travis-ci/push
• continuous-integration/appveyor/branch