[darwin]: pass the remaining Go pointers as unsafe.Pointer on darwin

Finish what ccd5ddb ("[darwin]: pass kernel buffers as unsafe.Pointer on
darwin") started. Two arguments that point at Go memory were still
declared uintptr: valuePtr on CFNumberGetValue, which CoreFoundation
unboxes the number into, and inputStruct/outputStruct on
IOConnectCallStructMethod, which IOKit reads the SMC request from and
writes the reply into.

Both were latent rather than broken. fillStat takes the address of a stat
whose pointer it returns, and callSMC allocates its structs with new, so
escape analysis put all three on the heap and the addresses happened to
stay valid. Neither call site guarantees that, and the argument type is
what should.

purego draws the line exactly here: reflect.Ptr, reflect.UnsafePointer
and reflect.Slice all reach the C side through reflect.Value.Pointer()
and stay reachable for the duration of the call, while reflect.Uintptr is
passed as a bare integer with no keep-alive at all.

Drop CStr.Addr, which has no callers left and whose own doc comment
warned against the only thing it could be used for. Move the explanation
of the rule above the first type block that depends on it, and state the
converse as well, so the handles that are correctly uintptr -- CF and
IOKit object references, mach ports, Dlsym'd data symbols, mach vm
addresses -- are not converted by mistake later.