8e4d51aa1f
`PipeQuery::new` create a `PipeQuery` wrapper before handling errors, so
we ended up calling `drop` and destroy_query, meaning the latter ended up
being called twice.
While at it, also restrict visibility of related methods and add some
unsafe declarations.
Fixes: 52e53938c3 ("rusticl: Wrap pipe queries")
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/24938>