Split safe_call between redisplay and non-redisplay versions

Split safe_call between redisplay and non-redisplay versions

The `safe_call/eval` family of functions started its life in `xdisp.c`
for the needs of redisplay but quickly became popular outside of it.
This is not ideal because despite their name, they are somewhat
specific to the needs of redisplay.

So we split them into `safe_call/eval` (in `eval.c`) and `dsafe_call/eval`
(in `xdisp.c`).  We took this opportunity to slightly change their
calling convention to be friendly to the CALLN-style macros.
While at it, we introduce a new `calln` macro as well which does
all that `call[1-8]` used to do.

* src/eval.c (safe_eval_handler, safe_funcall, safe_eval): New functions,
Copied from `xdisp.c`.  Don't obey `inhibit_eval_during_redisplay` any more.
Adjust error message to not claim it happened during redisplay.

* src/lisp.h (calln): New macro.
(call1, call2, call3, call4, call5, call6, call7, call8): Turn them
into aliases of `calln`.
(safe_funcall): Declare.
(safe_calln): New macro.
(safe_call1, safe_call2): Redefine as compatibility macros.
(safe_call, safe_call1, safe_call2): Delete.
Replace all callers with calls to `safe_calln`.

* src/xdisp.c (dsafe_eval_handler): Rename from `safe_eval_handler`.
Adjust all users.
(dsafe__call): Rename from `safe_call` and change calling convention to
work with something like CALLMANY.  Adjust all users.
(safe_call, safe__call1, safe_call2): Delete functions.
(SAFE_CALLMANY, dsafe_calln): New macros.
(dsafe_call1, dsafe_eval): Rename from `safe_call1` and `safe_eval`,
and rewrite using them.  Adjust all users.
(clear_message, prepare_menu_bars, redisplay_window): Use `dsafe_calln`.
(run_window_scroll_functions): Don't let-bind `Qinhibit_quit`
since `safe_run_hooks_2` does it for us.