The scalar_at and scalar_at_unchecked API is easy to misuse

[danking]

There are two core issues:

1. scalar_at / scalar_at_unchecked can be called at least three ways: scalar_at(array, index), encoded_array.scalar_at(index), and array.with_dyn(|a| a.scalar_at(index). The semantics of the latter two differ from that of the first.

2. There are four possible combinations of bounds-checking and validity-checking but for any given pair of scalar_at / scalar_at_unchecked, only two versions are available. Moreover, no option performs validity checks without bounds checks.

   function	bounds checked	validity checked
   scalar_at(array, index)	yes	yes
   scalar_at_unchecked(array, index)	no	no
   encoded_array.scalar(index)	yes	no
   encoded_array.scalar_at_unchecked(index)	no	no

   NB: with_dyn has the same semantics as the second pair.