FloatFormat should be an unsafe trait

[shumpohl]

Some unsafe code relies on RawExponent::raw_exponent() < FloatFormat::base_pow_exponent_digits() to be sound. Currently a user could write a custom float type in safe rust and trigger UB by messing up the trait implementation.

Example:
https://github.com/bsteinb/accurate/blob/master/src/sum/onlineexactsum.rs#L63