fuzz: Add a fuzz target for table.{get,set} operations

This new fuzz target exercises sequences of `table.get`s, `table.set`s, and
GCs.

It already found a couple bugs:

* Some leaks due to ref count cycles between stores and host-defined functions
  closing over those stores.

* If there are no live references for a PC, Cranelift can avoid emiting an
  associated stack map. This was running afoul of a debug assertion.

tests/all/gc.rs

@@ -47,12 +47,9 @@ fn smoke_test_gc() -> anyhow::Result<()> {
         "#,
     )?;
 
-    let do_gc = Func::wrap(&store, {
-        let store = store.clone();
-        move || {
-            // Do a GC with `externref`s on the stack in Wasm frames.
-            store.gc();
-        }
+    let do_gc = Func::wrap(&store, |caller: Caller| {
+        // Do a GC with `externref`s on the stack in Wasm frames.
+        caller.store().gc();
     });
     let instance = Instance::new(&store, &module, &[do_gc.into()])?;
     let func = instance.get_func("func").unwrap();