Safe menu initialization for the Windows platform

[parasyte]

#227 made Menu::init_for_hwnd() and friends unsafe. While this is a good idea for methods with this type signature, the change harms usability.

My proposal is making safe alternatives to these methods via the raw-window-handle crate. These methods can accept a reference that implements the HasWindowHandle trait. This proposed design avoids the requirement for callers to uphold the invariant that the hWnd must be valid; that is ensured by the trait implementer. In other words, unsafety will be properly encapsulated.