Move `buf` constructors into `pixel`

[HeroicKatora]

Based on review on Discord: The internal buf type upholds one invariant of pixels, namely that its bytes are always aligned correctly. It would be better to have that concentrated in a single module. Since there is no way to safely construct an unsized wrapper there is little risk to silently introduce another way that circumvents this restriction. This would incidentally leave pixel as the only module containing unsafe code.