Add thread-safe Steihaug, BOBYQA and NEWUOA trust-region optimizers

[mattfidler]

Adds three trust-region optimizers. Like trust(), each has an R function and a thread-safe C entry point with no R API calls and no global state, so it can be used as an inner or outer optimizer inside nlmixr2est's parallel C++ code.

R function	Ported from	Needs	C entry point
steihaug()	Rust crate basin (commit 86cc0d6)	gradient + Hessian, or Hessian-vector products	steihaug_solve_c()
bobyqa()	minqa 1.2.8 (Powell's Fortran)	function values; box bounds	bobyqa_solve_c()
newuoa()	minqa 1.2.8 (Powell's Fortran)	function values	newuoa_solve_c()

UOBYQA is not included: it needs O(n²) points, and NEWUOA covers the same case.

How closely the ports match

• BOBYQA and NEWUOA are line-by-line translations. Results are bitwise identical to minqa's Fortran on x86_64 (par, fval, feval, ierr and iprint output) across 250+ comparison runs plus 300 random ones.
  • The R wrappers reproduce minqa's R/minqa.R semantics.
  • One deliberate difference: minqa's rescue.f calls CALFUN(N,X,IPRINT) with X undefined inside RESCUE, so it evaluates the objective at uninitialized memory and results aren't repeatable. The port uses Powell's intended W(1..N). Runs that enter RESCUE match a copy of minqa with only that line fixed.
• Steihaug matches a basin reference program bit for bit on 33 setups, each in exact and matrix-free mode: every evaluation point, iteration count, termination reason and evaluation count.
  • Defaults that differ from basin: maxit = 100 and an absolute gradient tolerance of 1e-8.
• FMA contraction is disabled in the ported files, so the bitwise agreement doesn't depend on compiler flags.

Downstream interface

• .RcppTrustPtr() and inst/include/RcppTrust.h gain appended slots: bobyqa_solve_c, newuoa_solve_c, minqa_result_free, steihaug_solve_c, steihaug_result_free. Existing slots are unchanged.
• When a consumer was built against a newer header than the installed RcppTrust, the missing slots are NULL.

Other changes

• License is now GPL-2, because the minqa-derived code can't be distributed under MIT. The notices for the trust and basin code are kept in inst/COPYRIGHTS.
• Version bumped to 0.2.0; NEWS.md added.
• NAMESPACE is now roxygen-managed.
• New vignette, vignette("trust-region-methods"); README and the main vignette updated.

Testing

• tests/testthat/test-minqa.R: exact comparison with minqa when it is installed (approximate on non-x86_64), error codes, R error propagation.
• tests/testthat/test-steihaug.R: basin reference counts, matrix-free vs exact, termination reasons, input validation.
• OpenMP stress tests: each solver gives bitwise-identical results on 64 starts, run sequentially and across threads.
• The C interface's edge cases (NULL options, zero start, bad n) were run under AddressSanitizer and UBSan.
• R CMD check --as-cran: 1 NOTE, a non-portable compiler flag from this machine's R configuration.

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️