more resiliency to buggy user code in IdOrdMap

[sunshowers]

• Use a two-phase commit pattern where no user code runs in between changing the btree table and changing the map. This requires switching over from BTreeSet to BTreeMap<_, ()>, but that is just what's required to be able to express this pattern.
• If, for whatever reason (either a buggy comparator or some RefMut trickery), an efficient remove lookup didn't work, switch to a linear scan to ensure the index is removed. This ends up being load-bearing for aliasing.
• Extend the panic safety tests to also cover Drop.