Fix intentional unsoundness in `Ptr::split_at`

[joshlf]

In order to avoid unnecessary code changes as part of a multi-step transition, #1889 introduces intentionally unsound code into Ptr::split_at. This code is guaranteed to never exhibit UB as written, but it is unsound if we treat ourselves as existing behind a veil of ignorance with respect to the implementation of Ptr::assume_aliasing. We cannot publish a new stable release until this is fixed.

Note for those following along at home: This only affects main, which holds the 0.9.0-alpha release train. 0.8 is unaffected.