Revisit making `String`'s `Arbitrary` implementation fallible

[Nick Fitzgerald]

At least during test case reduction, it would be better to use from_utf8_lossy, because we would rather have some replacement chars in a smaller string than fail to generate a Self.

Possibly we could set an environment variable from cargo fuzz tmin that changes this behavior, if we still want test case generation to be fallible rather than use replacement chars.

cc @Manishearth

[Manish Goregaokar]

Hmm, makes sense

[Manish Goregaokar]

I think it's important for fallibility to be an option since without that the fuzzer is worse at generating useful strings and also slower.

[Nick Fitzgerald]

Fixed (albeit with a slightly different approach than what was discussed here) in #53