Appending elements across documents allows for memory unsafety in safe client code

[shepmaster]

extern crate sxd_document;

use sxd_document::Package;

fn main() {
    let p1 = Package::new();

    {
        let p2 = Package::new();

        {
            let d1 = p1.as_document();
            let d2 = p2.as_document();

            let e1 = d1.create_element("hi");
            d2.root().append_child(e1);

            let e2 = d2.create_element("bye");
            d1.root().append_child(e2);
        }
    }

    {
        let d1 = p1.as_document();
        for c in d1.root().children() {
            println!("{:?}", c);
        }
    }
}

When p2 goes out of scope, it takes its children with it, even though p1 retains a reference. Related to #8, but a critical safety issue.