Fix: ZipperHead fixes

[imlvts]

Fix ZipperHead exclusive path at the head's own root
With an empty path and the head's root inside a node, the walk popped a
byte of the head's own path and never put it back. The next request then
read past its key buffer (UB in release) or panicked.

Fix zipper_head on a write zipper with a borrowed path
as_static_path_zipper asserted the zipper held no borrowed origin path,
but write_zipper_at_path always does. Once buffers are prepared the path
lives in prefix_buf, so drop the borrowed slice instead.

Fix ZipperHead exclusive paths over an empty node
make_cell_node called make_mut on the empty sentinel, which panics.
Replace the sentinel with a new CellByteNode instead.

[luketpeterson]

I was initially confused because this PR originally held 3 separate ZH fixes. But the PRs that came before it contained 2 of them.

So, on top of the master branch with the others merged, this PR covers the case where the an empty node sentinel needs be upgraded to a CellByteNode to support a ZipperHead.

Good fix. Merging.