macOS: Refactor NSView subclass implementation

[prokopyl]

This PR introduces a safe wrapper around the AppKit NSView creation and lifecycle.

While a large part of objc2's API surface is safe, managing our custom-class' instance variables is not. And because our custom class is dynamically generated, there is no check for correctness of the subclass' methods signatures.

These two parts are what this wrapper handles, the rest is delegated to objc2's existing APIs.

This PR also introduces safe wrappers around the NSView's timer and notification observers, making them correctly de-register themselves when the NSView is deallocated, while not holding the NSView itself alive for too long.

This PR also completely overhauls the NSView ownership structure. It previously had a clunky WindowInner > NSView > WindowState > WindowInner > NSView ownership cycle that had to be manually broken.

Now the NSView properly and directly owns all of its internal state and object, except for the tiny bit of WindowSharedState that's needed by the WindowHandle (and now doesn't reference the NSView at all anymore).

Doing this also allowed to properly initialize the WindowHandler only after the NSView was fully initialized and parented, fixing #248.