Clarify lifetime of DiskIoMgr::BufferDescriptor objects

The transfer of DiskIoMgr::BufferDescriptor objects between different parts of the code is somewhat subtle. It would be good to enhance the code so that the ownership transfer was more explicit and it was easier to spot errors via inspection or assertions.

Some ideas:

• We could use unique_ptr instead of raw pointers - there is always a single owner of a BufferDescriptor
• We could add a DCHECK to the destructor to ensure it is returned.
• We don't really need to cache and recycle the objects (it's probably a pessimisation compared to TCMalloc's small object caching).