critical: don't let the ceiling token escape the critical section

tests/cfail/ceiling.rs

@@ -1,6 +1,6 @@
-extern crate cortex_m_srp;
+extern crate cortex_m_srp as rtfm;
 
-use cortex_m_srp::{C3, P2, Resource};
+use rtfm::{C3, P0, P2, Resource};
 
 static R1: Resource<(), C3> = Resource::new(());
 
@@ -13,3 +13,13 @@ fn j1(prio: P2) {
     // Would be bad: lockless access to a resource with ceiling = 3
     let r2 = R1.borrow(&prio, c3);
 }
+
+fn j2(prio: P0) {
+    let c16 = rtfm::critical(|c16| {
+        // forbidden: ceiling token can't outlive critical section
+        c16  //~ error
+    });
+
+    // Would be bad: lockless access to a resource with ceiling = 16
+    let r1 = R1.borrow(&prio, c16);
+}