Metal: Port existing and extend new Metal4 no-unsafe annotations

The new `Metal4` types inherit a lot of functions from older Metal
versions that need to be annotated to not be unsafe, so that they
can be more trivially called.

Author: MarijnS95