This change moves the meat of the code for fuzzing `regalloc2` into the
main crate's `fuzzing` module. This has several minor benefits (easier
to find, better LSP detection, same workspace for `cargo fmt|clippy`)
but the major one is we can not only build, but also _run_ some fuzz
tests with:

```
cargo test --features fuzzing
```

The fuzz modules now use `arbtest` to run one second worth of fuzzing.
This should be helpful both during development and in CI.

The second part of this change is a reorganization of the fuzz targets
themselves. In looking at them carefully, I realized:
- `ion` and `ion_checker` were doing essentially the same thing; in
  fact, we probably always want to run the checker after allocation
- `ssagen` was not necessary: we could get the same functionality by
  flipping the `enable_ssa_checker` flag on `fastalloc|ion::run()`
- we never fuzzed with annotations off (not sure why we would not want
  to but... shrug)

This led to randomly flipping the annotations and SSA checking flags,
renaming `ion_checker.rs -> ion.rs` (replacing `ion.rs`) and
`fastalloc_checker.rs -> fastalloc.rs`. `ssagen.rs` is now gone,
subsumed by now being able to check the SSA in both `ion.rs` and
`fastalloc.rs`.

This naming change will undoubtedly require some re-configuration in
OSSFuzz but that can happen later.

Now that we can run the fuzzers with `arbtest`, we use `cargo test
--all-features` to run all of these for one second. This allows cleaning
up the building of the fuzz targets themselves and the static set of
smoke tests in `*.bin` for the old `ion_checker`.