Creusot: a Foundry for the Deductive Verification of Rust Programs