Use UnsafeWorldCell to increase code quality for SystemParam

[joseph-gio]

Objective

The type &World is currently in an awkward place, since it has two meanings:

1. Read-only access to the entire world.
2. Interior mutable access to the world; immutable and/or mutable access to certain portions of world data.

This makes &World difficult to reason about, and surprising to see in function signatures if one does not know about the interior mutable property.

The type UnsafeWorldCell was added in #6404, which is meant to alleviate this confusion by adding a dedicated type for interior mutable world access. However, much of the engine still treats &World as an interior mutable-ish type. One of those places is SystemParam.

Solution

Modify SystemParam::get_param to accept UnsafeWorldCell instead of &World. Simplify the safety invariants, since the UnsafeWorldCell type encapsulates the concept of constrained world access.

---

Changelog

SystemParam::get_param now accepts an UnsafeWorldCell instead of &World. This type provides a high-level API for unsafe interior mutable world access.

Migration Guide

For manual implementers of SystemParam: the function get_item now takes UnsafeWorldCell instead of &World. To access world data, use:

• .get_entity(), which returns an UnsafeEntityCell which can be used to access component data.
• get_resource() and its variants, to access resource data.

[alice-i-cecile]

Currently at least this appears to be completely non-breaking.

[joseph-gio]

Any manual implementations of SystemParam will be broken.