Issue Description:

We should provide a guarantee of pointer stability not just within the `withUnsafePointer` closure, but also with across multiple calls with `withUnsafePointer`, `@inout` arguments, and C functions that access the same global.

For example:

C code:

struct MyStruct {
 int field;
};
extern const struct MyStruct myGlobal;
void takePointer(const struct MyStruct *);

Swift code

withUnsafePointer(to: myGlobal) {
 takePointer($0)
}

The implementation should guarantee that the pointer passed to `takePointer` is the address of `myGlobal`:

$0 == &myGlobal

I think this rule should apply to globals and class properties. @lorentey also proposed a "stable storage" language extension, so there might be some overlap with that.