Mark reviewed DeviceCheck methods safe

[LucaCappelletti94]

Enables the blanket safety defaults for DeviceCheck, which makes DCDevice and DCAppAttestService::sharedService safe. Their completion handlers already take a SendableBlock, and on macOS 26.6.2 the token handler does run on a framework thread, so nothing more is needed there.

The four DCAppAttestService instance methods stay unsafe, and I checked them the way #864 checked LocalAuthentication. Each goes through -[DCAppAttestService appAttestController], which on macOS 26.6.2 creates its controller lazily with a plain load, store and release of the previous value, and sharedService hands that one instance to every thread.

Calling the getter from eight threads on fresh instances crashes in objc_release inside it within a thousand rounds, while the same harness with the controller created beforehand runs 100,000 rounds cleanly. The precondition is therefore only that the first call must not race another call on the same instance, a bit of an unfortunate implementation choice.

App Attest only works on iOS and iPadOS, since isSupported answers NO on a Mac. The iOS 26.1 decompilation shows the same lazy _appAttestController getter, while the iOS 18.2 one has no such ivar. Other releases are unverified.

Code that forbids unsafe still cannot read the *mut NSData and *mut NSError these handlers receive until #837 lands.

The regenerated bindings are in the generated fork.

[madsmtm]

Thanks for working on this.

Same as with #864, could I get you to file a FB with Apple about this?

---

Surprisingly, we probably could work around this by adding this to lib.rs:

// #[ctor]
#[used]
#[link_section = "__DATA,__mod_init_func,mod_init_funcs"]
static INIT: extern "C" fn() = {
    extern "C" fn init() {
        let _ = DCAppAttestService::sharedService();
    }
    init
};

Not sure how good of an idea this would be though, since the user could (very theoretically) still end up in a situation where they themselves spawn threads and use DCAppAttestService from a ctor that runs before this one, so I'd prefer to wait with doing that until we hear from Apple.

[madsmtm]

Am I misunderstanding? Isn't it DCAppAttestService.sharedService that should be unsafe, and the rest that are safe?