Safe Pontryagin Differentiable Programming