floss: Introduce LTCheckedPtr/Mut (Lifetime-checked pointer) to topshim

The wrapper holds the raw pointer and clones the lifetime from the
pointing object, which forces the compiler to check and fail when the
wrapper lives longer than the data.

Bug: 249687132
Tag: #floss
Test: build.py --target test; Deployed to CB and checked basic features
Change-Id: I07a81a0d8b262d0d0008709164d460fa7e86b0e1