Remove unsafe from encoder using extend pattern

[bonega]

Summary

• Replace raw pointer manipulation in encoder.rs with safe Vec::with_capacity + extend + flatten pattern
• Removes 2 unsafe blocks (reduces total from 18 to 16)
• Performance is equivalent or better

Benchmark Results

The mostly_ascii path is ~40% faster due to better iterator optimization.

Approach

let mut res = Vec::with_capacity(len);
res.extend(
    (0..len)
        .map(|_| self.encode_grapheme(&mut src).or(fallback))
        .flatten(),
);

The key insight is that extend() uses the iterator's size hint to avoid per-element capacity checks when capacity is pre-allocated.

Test plan

• All existing tests pass
• Benchmarks show no regression