Change a bunch of Pal functions to use Rusty error handling

Big MR, but still doesn't cover the full Pal API. Also fixes some unsoundness where C functions taking pointers weren't marked unsafe.