replace many unsafe_convert methods with safer cconvert ones (#51764)
This seems the correct way to define most conversions, since the unsafe
logic should typically be isolated to a few areas, and everywhere else
just defines conversions to it. This ensures the root is preserved even
if the user later makes unexpected changes to the parent object
(although the length might have later become inconsistent at that point,
so it is not a guaranteed fix for memory issues).