fuzzing

[pufferfish101007]

implements some fuzzing facilities using libafl. Adds the Arbitrary and Mutate traits to structured sb3 so that we can mutate it while mainti0aining well-formedness (which wouldn't be possible if working with the raw json)

some of this is LLM-written and needs to be heavily reviewed/rewritten before merging. but the testcase reduction does work.

sb2/src/structured/{mutate,arbitrary}.rs were written by a human (me) i think.

fuzzing probably works but it's difficult to test properly because the compiler has too many bugs and missing features at the moment.

note that this uses the unstable macro_rules attribute macros feature (for the arbitrary_with_context macro in sb3), which causes problems with rust-analyzer and rustdoc on the current nightly version; rustdoc issues should be fixed on an upgrade but not sure about r-a.

TODO:

• do we need both Arbitrary and Mutate for structured sb3? If we allow mutate to create increasing mutations as well as decreasing, then it shouldn't be necessary
• test case reduction needs massive cleanup and ideally separation from libafl
• all other bins in fuzz-libafl were heavily LLM generated so need rewritten or at least very thorough review
• is libafl even necessary? we're not using coverage guidance (consider: should we?) or anything fancy so it might all be way more complicated than it needs to be