Make rd_kafka_destroy a safe foreign call

- It blocks until everything is being destroyed
- It might trigger callbacks

Documentation from librdkafka:

```
/**
 * @brief Destroy Kafka handle.
 *
 * @remark This is a blocking operation.
 * @remark rd_kafka_consumer_close() will be called from this function
 *         if the instance type is RD_KAFKA_CONSUMER, a \c group.id was
 *         configured, and the rd_kafka_consumer_close() was not
 *         explicitly called by the application. This in turn may
 *         trigger consumer callbacks, such as rebalance_cb.
 *         Use rd_kafka_destroy_flags() with
 *         RD_KAFKA_DESTROY_F_NO_CONSUMER_CLOSE to avoid this behaviour.
 *
 * @sa rd_kafka_destroy_flags()
 */
RD_EXPORT
void        rd_kafka_destroy(rd_kafka_t *rk);
```

src/Kafka/Internal/RdKafka.chs

@@ -827,7 +827,7 @@ newRdKafkaTopicConfT = do
  {enumToCInt `RdKafkaTypeT', `RdKafkaConfTPtr', id `CCharBufPointer', cIntConv `CSize'}
  -> `RdKafkaTPtr' #}
 
-foreign import ccall unsafe "rdkafka.h &rd_kafka_destroy"
+foreign import ccall safe "rdkafka.h &rd_kafka_destroy"
  rdKafkaDestroy :: FunPtr (Ptr RdKafkaT -> IO ())
 
 newRdKafkaT :: RdKafkaTypeT -> RdKafkaConfTPtr -> IO (Either Text RdKafkaTPtr)