`System` should be an `unsafe trait`

[ItsDoot]

Since its introduction in 0.11, System::update_archetype_component_access has had a memory safety requirement for implementers (but not callers) regarding the UnsafeWorldCell that's passed to it:

bevy/crates/bevy_ecs/src/system/system.rs

Lines 156 to 161 in cd67bac

	/// Update the system's archetype component [`Access`].
	///
	/// ## Note for implementers
	/// `world` may only be used to access metadata. This can be done in safe code
	/// via functions such as [`UnsafeWorldCell::archetypes`].
	fn update_archetype_component_access(&mut self, world: UnsafeWorldCell);

Therefore, System must be marked as unsafe to implement by making it an unsafe trait. However, this is not currently the case:

bevy/crates/bevy_ecs/src/system/system.rs

Line 35 in cd67bac

pub trait System: Send + Sync + 'static {

This should be rectified.

[SkiFire13]

A possible alternative to keep System safe would be using a wrapper over UnsafeWorldCell that only allows accessing the world's metadata, that way there woud be no way for implementers to misuse it.

[tim-blackbird]

Accessing anything other than metadata via UnsafeWorldCell is already unsafe, so there is no way to misuse it here without opening an unsafe block.
I like @SkiFire13's suggestion to prevent the possibility of misuse entirely.

edit: Just noticed #15289, that's what I get for now reading everything on discord before commenting

[chescock]

I don't believe that needs to be a safety requirement. That note isn't adding additional requirements to the implementer, it's merely reminding them of the existing requirements declared by UnsafeWorldCell.

Many methods that take an UnsafeWorldCell are unsafe fns that have additional privileges, and this is unusual in being a method that takes an UnsafeWorldCell but that cannot call any unsafe methods on it.

Put another way: I don't believe it's possible to create UB with a bad System implementation in purely safe code, so the impl doesn't need to be unsafe. (I'm happy to be proven wrong if you can construct a counter-example!)