feat: let a created buffer be filled through the safe API

[u5surf]

Closes #327.

Adds two methods to MutableBuffer:

fn spare_capacity(&self) -> usize;
fn append(&mut self, bytes: &[u8]) -> Option<()>;

So a buffer from create_buffer can be filled without leaving the safe API:

let mut buf = request.pool().create_buffer(body.len())?;
buf.append(body)?;
buf.set_last_buf(true);

append writes nothing and returns None when the bytes do not fit, rather
than filling what it can. A caller that ignores the result then gets an empty
buffer instead of a truncated value.

Nothing existing changes behaviour; both methods are new defaults on the trait.
Tests cover a fresh buffer, two appends, and an overflow.