Lazy config
Next piece of #2848.
* `config.rustc` and `config.rustdoc` are now lazy.
* `Rustc` and not `config.rustc` now knows the path to the compiler.
* `LazyCell` is used to implement laziness
No new tests are added, because we need to lazify `target_path` to deal with broken cargo config.
`target_path` is a bit peculiar. It is always accessed as `ws.config.target_path(ws)`, and has a setter. Perhaps it belongs to the workspace? Will look into that later.