Fix bounds on Send and Sync impls for lock guards

[Amanieu]

Fixes #258
Fixes #259

[ammaraskar]

Thank you! ❤️

[RalfJung]

I have looked at this in our formal soundness proof of (idealized) Mutex and RwLock implementations. I can confirm that T: Send implies MutexGuard<T>: Send.

However, for RwLock, things are more tricky. The way we have set up the proofs, we need both T: Send and T: Sync to show that either of the guards is Send. However, I think that is just an artifact of out proof -- I agree that these ought to be sound.

[jhjourdan]

I had a more precise look on the formal proofs than @RalfJung did, and it turns out that indeed, it is safe to:

• make the read guard both Send and Sync as soon as T : Sync,
• make the write guard Send as soon as T : Send,
• make the write guard Sync as soon as T : Sync.

[RalfJung]

IOW, the read guard behaves like a shared reference and the write guard behaves like a mutable reference. Exactly what one would expect. Thanks @jhjourdan!

[ammaraskar]

Thanks for double-checking and formally proving this Ralf and Jacques. Good to see that this matches the intuition from #258 (comment)