enforce scope shadowing statically with an extra phantom lifetime

[dherman]

Fixes #11.

This API change tracks an additional lifetime parameter on a Scope representing the block in which the scope appears, and makes all the allocation API's require an &mut pointer to the scope. The nesting methods then freeze an outer scope so the allocation methods are statically prevented from using it while frozen. But because the allocation methods return a handle tied to the extra block lifetime, rather than the lifetime of the scope pointer itself, multiple allocations within a single block do not cause spurious borrow checker errors.

The net effect is that allocations do not require a dynamic check to enforce that they are not being performed on a Scope that is currently shadowed.