fix: detect serde attributes inside macros

[Boshen]

A #[serde(with = "...")] inside a macro body is invisible to the parser, so the dependency is reported as unused:

macro_rules! config {
    ($name:ident) => {
        pub struct $name {
            #[serde(with = "humantime_serde")]   // never seen
            pub timeout: std::time::Duration,
        }
    };
}
config!(Config);

It gets worse if the crate also uses the dependency in a dev target. The macro-generated usage is the lib's only visible one, so the dev usage looks like the only usage and cargo-shear escalates to an error:

× misplaced dependency `humantime-serde`
  help: move this dependency to `[dev-dependencies]`

--fix applies that, moving a dependency the lib genuinely needs and breaking the build.

The fix

A macro body keeps its attributes as plain tokens, so they never become Attr nodes and never reach collect_meta_imports, which is the only thing wired to collect_serde_attribute. collect_token_tree already recovers :: paths from macro bodies for exactly this reason, so the serde scan belongs there too.

It's gated on a serde ident being present in the token stream, so unrelated attribute macros are unaffected. An attribute's own path sits outside its token tree, so #[serde(...)] isn't scanned twice and existing behaviour is untouched.

serde_attributes_inside_macro fails without the fix — imports come back empty instead of {"foo"}. It covers every key in is_serde_attribute_key (with, deserialize_with, serialize_with, crate, remote) across both a macro_rules! definition and a macro invocation. crate earns its line: it's a keyword rather than an ident, so it takes a separate branch in the key check.

Unit-only is deliberate — the defect is in the parser, and everything downstream is generic and already covered by misplaced, clean, and unused_naming_hyphen.

Refs #542

This fixes the unused → misplaced escalation reported there. The redundant_ignore step doesn't reproduce on main and I think the report telescopes two versions: that step requires the misplaced condition to be false while misplaced_dependency requires it true, and when it holds #367 already suppresses the ignore. It most likely predates #367 landing in v1.10.0.

Left as Refs rather than Closes — worth confirming with robjtede that their serde(with = "...") is macro-generated first.