Ensure panic safety for all FFI methods.
This commit changes all FFI functions to take an `out_err` param, so
that they're called using `call_with_result`. Any functions that don't
have a `[Throws]` annotation in the IDL will throw a generic
`InternalError` instead.
Closes #32.
