Make Vec::set_len enforce the len <= cap invariant

[scottmcm]

@mcy

All that said, the documentation should be a bit more clear as to how dangerous this method is, and maybe get rid of some of the sillier examples.

I'm absolutely in favour of some more-realistic examples here. Maybe one that passes the buffer over FFI and then set_lens to number of items that external code claims to have written?