Read config from more standard locations

[theaddonn]

Implements #645.

read_tree_config currently only looks at .cargo/mutants.toml. This adds four more locations, searched in this order, first match wins:

1. .cargo/mutants.toml
2. mutants.toml
3. .mutants.toml
4. .config/mutants.toml
5. [workspace.metadata.mutants] in the root Cargo.toml
6. [package.metadata.mutants] in the root Cargo.toml

.cargo/mutants.toml stays first, so nothing changes for existing trees. Configs are never merged across locations, matching the current single-file behaviour. --config and --no-config are unchanged.

The metadata tables deserialize into the same Config struct, so deny_unknown_fields still applies and a typo in [workspace.metadata.mutants] is still an error. No new dependencies: this uses the toml crate already in the tree.

Tests in tests/main.rs cover each location and every precedence step, plus an invalid key in the metadata table and --no-config. Docs are updated in book/src/config-file.md and there's a NEWS.md entry.

cargo fmt --check, cargo clippy --all-targets --all-features -- -D warnings, and cargo test --all-features are all clean locally.

A couple of things worth a second look:

• read_tree_config now tests is_file() rather than exists(), so a directory named mutants.toml falls through to the next candidate instead of erroring.
• I also updated the stale mention in src/options.rs; happy to drop that if it's out of scope.

Written with AI assistance (Claude Code), following AGENTS.md. I've reviewed and tested it.