Add discovery of fuzz targets

[sunshowers]

Ideally we'd just be able to use the inventory crate and be able to register fuzz targets, but there are some worrisome issues which might mean we miss some :(

The alternative way @dtolnay and I discussed is to statically analyze the Rust source using syn-inline-mod, looking for any instances of the #[propfuzz] macro. This is quite a bit hackier as we have to deal with a bunch of terrible crate visibility issues, but combined with guppy plus some clever hacks it should work in most cases.

[sunshowers]

This is coming along nicely -- once the upstream change at TedDriggs/syn-inline-mod#17 lands, we should have most of what we need.