Add API for making buffers write-only, and allow reading from them by default

[madsmtm]

In #313, I added a note that reading from the pixel buffer is discouraged, because I wanted to set kIOSurfaceMapWriteCombineCache on macOS once I got around to implementing proper IOSurface support. See e.g. the following links for a few places where it's used in the wild:

• WebKit on iOS: https://bugs.webkit.org/show_bug.cgi?id=130982
• Chromium (was later backed out though): https://chromium-review.googlesource.com/c/chromium/src/+/6575828

I thought this was fine, because I couldn't see a use-case where you'd need to read from the pixel buffer, but that was perhaps a bit hasty, I found at least one use-case: converting the alpha mode (premultiplying components or making the alpha channel opaque) by modifying the buffer in-place in a separate step before presenting it buffer.

This means that the argument for only having the mutable version instead of distinct pixels/pixels_mut, pixel_rows/pixel_rows_mut and pixels_iter/pixels_iter_mut methods is a bit weaker.

WDYT? Should we provide both immutable and mutable methods on Buffer<'_>?