ITER Safety: Lessons Learned for the Future