Fix panic safety when reserving during splice

[charliermarsh]

This PR fixes a double free when splice panics while reserving space:

use smallvec::SmallVec;

let mut v: SmallVec<Box<u8>, 4> = SmallVec::from_buf([Box::new(7)]);
drop(v.splice(0..0, std::iter::repeat_with(|| Box::new(1))));

While reserving, we temporarily increase the vector's length to include the elements we're keeping. If reserve panics, we skip resetting the length, so cleanup adds those elements a second time.

Instead, we can use try_reserve which allows us to reset the length before panicking.