Add a top-down code generation option to wasm-smith

[fitzgen]

Right now we generate bottom up, based on what is on the stack.

This means that we pre-filter instructions that require "rare" stacks, making their generation even rarer.

We should also add the ability to generate code top down, where we first choose the instruction we want to generate, and then ensure that the prerequisite operand values are also generated and pushed onto the stack first. This avoids the "pre-filter" and makes "rare" stacks more likely.

We could even switch between the two approaches within the same function body.

cc @alexcrichton @cfallin @jameysharp