docs: Document snippet reviewing process

[jan-ferdinand]

No description provided.

[Sword-Smith]

Very cool. Two remarks:

1. I think it's worth stating that extra checks (security in-depth or redundant checks) are OK and should not necessarily be removed even though they are not part of the contract. An example could be that the contract states that the inputs are valid u32s but the snippet has a check that some of the values actually are u32s. You could argue that that's a redundant check since is part of the contract, but once in a while I think extra checks of that kind make sense, since it reduces the mental overhead of what has and has not been verified already.
2. The requirements that each a field of each object instance is only ever accessed once is quite strict. I think there could be a few snippets where ensuring that requirement would be a challenge. As long as the field values are range-checked and the other points of the contract are upheld, we might want to be a bit more lax with this requirement. But this is not something, we have to change now. If I'm right, it'll be revealed during the review process.

[jan-ferdinand]

Regarding (2), what would wording be that captures your suggestion? Maybe something like: “Each field accessor is used at most once per struct instance, or range-checked before each use.”

You say that “the field values are range-checked”; is it actually the values of a field that should be range-checked? My current understanding is that the range check is required for dynamic size indicators (or is it length indicators?).

[jan-ferdinand]

I'm unsure about this addition because it lives in a publicly exposed function. Should downstream callers also be exposed to the potential panics generated here?