Previously, we allocated a 512-byte buffer for every call of the
formatted panic function. This was heavily increasing the stack size for
a number of functions.

We now don't print to a statically allocated buffer, but rather use the
iterator-based formatting facility and a proxy iterator with a small,
self-flushing buffer. This reduces that static overhead of the formatted
panic function to by almost 500 bytes, while increasing possible message
fidelity, since we are not longer arbitrarily limited by the buffer.

Previously, the number registry did a pruning pass whenever elements,
either all or a filtered subset, were queried by a consumer. This meant,
that every access to elements did an additional O(n) scan of the entire
registry, to ensure no expired devices were still registered. This used
to be necessary, when the ownership model for devices was still in flux.

With the established device ownership model, this has become obsolete.
Additionally, devices get numbered automatically when a device gains a
facet the is observed by the device number registry. Since registering
this type of facet is the responsibility of the device driver, since
only a driver can know how to implement that facet for any given device,
it also becomes the responsibility of the driver to revoke that facet
if and when a device is detached from the system. Any device is always
owned by the bus it is attached to. This means it is the bus'
responsibility to inform drivers about devices disappearing. This closes
the chain of responsibility cleanly, meaning the device number registry
will never have to prune itself in any accessors. Instead, it will be
informed by the facet registry that a facet for a device has been
revoked, allowing it to un-number that device if applicable.

The coding guidelines explicitly prohibit the use of "naked"/C-style
pointers. However, there were some prominent examples in the kapi and
the core kernel source. This changeset replaces them with the
appropriate smart pointer types.