Correctly mark `.unwrap_{leaf|branch}[_{ref|mut}]` methods as unsafe

[sdleffler]

As pointed out by burnsushi here a few gaffes have been made with respect to what internal functions should be marked unsafe (this is strictly about internal functions, and not the external API.)