fix: eliminate unsafe code in packet construction and stats counters

Replace all UnsafeCell-based counters with safe alternatives:

- New ShardedCounter: per-thread TLS accumulation (thread_local crate)
  with periodic publish to static AtomicU64. Zero atomic RMW on hot path.
- ACL RuleStatsTracker: remove unsafe Arc<RuleStats> raw pointer
  mutation, use two ShardedCounter fields.
- ZCPacket: replace set_len on uninitialized BytesMut with
  write_bytes + copy_nonoverlapping before set_len.
- StatsManager UnsafeCounter/MetricData: remove UnsafeCell and
  unsafe impl Send/Sync, wrap ShardedCounter. last_updated uses
  AtomicU64 epoch millis.
- Throughput: replace UnsafeCell with AtomicU64.
- secure_datagram: fix grace-window test timestamp.

Cargo.lock

@@ -2435,6 +2435,7 @@ dependencies = [
  "tempfile",
  "terminal_size",
  "thiserror 1.0.63",
+ "thread_local",
  "thunk-rs",
  "tikv-jemalloc-ctl",
  "tikv-jemalloc-sys",