The `Visitor` and `Visitable` traits methods should be marked unsafe

[declanvk]

1. The Visitor/Visitable trait methods likely all need to be marked unsafe, since they are operating on the raw nodes of the tree. The visitor implementations so far include "Safety" doc-comments requiring read-only access, but it probably should be recorded in the function signature
2. The visit_with functions work better when they're using a reference pointing to the actual location of N, not a local copy on the stack. For example, the DotPrinter will attempt to print node addresses by converting the given reference into a pointer, but this only really works if the reference points to the actual node location.