Ensure `ThisModule` invariants hold

[ojeda]

i.e. do not allow to create ThisModules without going through the constructor, even inside the kernel crate.

In addition, we should ensure the pointer is not passed to other modules. A solution would be to only allow to read the pointer through an unsafe get() method in ThisModule which explains this restriction and making the get() private outside kernel (i.e. kernel modules should not need to access the pointer inside ThisModule since they should not be calling the C bindings directly).

Furthermore, as a bonus, it would be nice to have a lint to warn about code creating ThisModule's objects on their own. In general, modules should only use the THIS_MODULE static provided via module!.

Finally, update the documentation as needed (e.g. currently we don't have an # Invariants in the doc comments).

[kloenk]

IMHO we should make stuff like ThisModule as repr transparent. Currently it probably gets optimized to that repr, but it's not guranteed. This also lets other code outside the kernel crate access the internal value with unsafe code. But that's always possible somehow.