Pixel struct makes it hard to render directly into the surface buffer #358

Rendering libraries (such as vello_cpu or tiny-skia) don't know about the Pixel type and expect to be able to render into &mut [u8]. Thus the current API design with Pixel makes it difficult to render directly into the softbuffer buffer (although it is possible with an unsafe cast).

I think that softbuffer ought to encapsulate the unsafe and provide methods for safely accessing the surface buffer and &mut [u8].