Handle arbitrary::Error::IncorrectFormat

[brson]

This is a fix for stellar/rs-soroban-sdk#1141, the basic problem described stellar/rs-soroban-sdk#1140 (comment)

If Arbitrary::arbitrary receives bytes it can't use it may return Error::IncorrectFormat. At present, if this happens the proptest will fail.

This patch uses the reject_local mechanism on the proptest test runner to reject these cases and try again. reject_local will eventually return an error if too many cases are rejected.

(I think we can probably do something similar for the random bytes buffer size, automatically increasing the buffer if Arbitrary returns NotEnoughData, but I have not done that yet).

[brson]

If you could publish a point release with just this fix that would be helpful, though I am looking at some further improvements.

[leighmcculloch]

👏🏻

[graydon]

@brson I'm happy to merge this if it makes things more robust and doesn't make future debugging worse (eg. by masking failures); but I should also mention that the underlying bug (stellar/rs-soroban-env#1175) is very high on my list and likely something I'll fix in the next couple days anyways. So like .. not sure how you'd prefer to proceed. Is it better to just wait for that and then unwind all the workarounds put in place because of it?

(I'm very sorry to have caused those)

[brson]

@graydon I think this patch is probably an improvement regardless of whether stellar/rs-soroban-env#1175 is resolved to not have arbitrary return this error code. ISTM that it is valid for arbitrary to fail in this way, and there are other strategies in the proptest crate that do this loop for similar reasons.