Reduce runtime panics through SystemParam validation

[MiniaczQ]

Objective

The goal of this PR is to introduce SystemParam validation in order to reduce runtime panics.

Fixes #15265

Solution

SystemParam now has a new method validate_param(...) -> bool, which takes immutable variants of get_param arguments. The returned value indicates whether the parameter can be acquired from the world. If parameters cannot be acquired for a system, it won't be executed, similarly to run conditions. This reduces panics when using params like Res, ResMut, etc. as well as allows for new, ergonomic params like #15264 or #15302.

Param validation happens at the level of executors. All validation happens directly before executing a system, in case of normal systems they are skipped, in case of conditions they return false.

Warning about system skipping is primitive and subject to change in subsequent PRs.

Testing

Two executor tests check that all executors:

• skip systems which have invalid parameters:
  • piped systems get skipped together,
  • dependent systems still run correctly,
• skip systems with invalid run conditions:
  • system conditions have invalid parameters,
  • system set conditions have invalid parameters.

[alice-i-cecile]

The opinions of the SME-ECS (@JoJoJet @maniwani @james7132 and myself) and frankly the rest of the ECS community are very positive on the broad direction of this work, so I'm marking it as X-Blessed.

[MiniaczQ]

validate_param is technically not unsafe, but we might want to mark it as so.
In theory, this method shouldn't access component values, despite having a readonly world access.

[alice-i-cecile]

Very pleased about how non-intrusive this is!

[hymm]

I made some comments on the safety for the single_threaded executor and I believe the simple executor has the same issues. It's late here so I might be missing something obvious, but I don't see update_archetype_component_access being called for the conditions for either of those two executors.

[SkiFire13]

Why does this mention update_archetype_component_access while the other validate_params mention init_state?

[MiniaczQ]

This was copy-paste from get_param/run methods, this means that they are also inconsistent with each other.
Agreed it should refer to update_archetype_component_access and some reference to new_archetype instead.

[MiniaczQ]

Addressed, let me know if that's sufficient.
If not I'm afraid we'll need a follow up PR since Alice wants this merged in the next train

[SkiFire13]

I guess it's good enough now, I'm ok with merging it and maybe improve the wording in a follow up PR

[alice-i-cecile]

Thank you to everyone involved with the authoring or reviewing of this PR! This work is relatively important and needs release notes! Head over to bevyengine/bevy-website#1691 if you'd like to help out.