Add "interposition" to the fuzzer's mutate() method

[kripken]

Before this PR we only mutated by replacing an expression with another, which
replaced all the children. With this PR we also do these two patterns:

(A
  (B)
  (C)
)

=> ;; keep children, replace A

(block
  (drop (B))
  (drop (C))
  (NEW)
)

,

(D
  (A
    (B)
    (C)
  )
)

=> ;; keep A, replace it in the parent

(D
  (block
    (drop
      (A
        (B)
        (C)
      )
    )
    (NEW)
  )
)

Even better would be to reuse the children by the new ((NEW)) expression,
but that would take significantly more work.

[kripken]

This was unused.

[tlively]

Maybe we can reuse children without significantly more work by walking the children of the replacement and randomly swapping them with the original children as long as the types are compatible.

[tlively]

LGTM otherwise, but it would be nice to put the ascii art from the PR description into the code comments.

[kripken]

Good ideas. I added the art and also to replace new children with old content.

[tlively]

Right now this will always replace the first child of rep with compatible type. For example, if rep is an i32.add and the children are i32 expressions, the LHS of rep will always end up being the last original child and the RHS will never be replaced. Should we have replaceChildWith collect and randomly pick from all of the possible child locations to increase the number of possible outcomes?

[kripken]

That makes sense, but we do have recombine() which will mix around things that way. Though we could perhaps add more logic there to reorder the children of an expression, which seems useful. How about leaving that as a TODO?