driver: document unsafe code in WDF function binding macro

[phaedrus1992]

The call_unsafe_wdf_function_binding! macro hides unsafe blocks from call sites, bypassing the workspace unsafe_code deny lint and preventing // SAFETY comments at invocation sites.

Currently ~20 call sites in ioctl.rs and lib.rs have no documented safety invariants.

Solution options:

1. Require callers to write their own unsafe { } block with SAFETY comment
2. Document macro-level preconditions that every caller is asserting

This is a refactoring task affecting multiple files in sideblinder-driver.