CI Fuzzing

Some notes on CI Fuzzing - this fuzzing is different to normal fuzzing campaigns as these are much shorter runnings.

Always:
- LTO has a much longer compile time which is diametrical to short fuzzing - hence use afl-clang-fast instead.
- If you compile with CMPLOG then you can save fuzzing time and reuse that compiled target for both the -c option and the main fuzz target. This will impact the speed by ~15% though.
- AFL_FAST_CAL - Enable fast calibration, this halfs the time the saturated corpus needs to be loaded.
- AFL_CMPLOG_ONLY_NEW - only perform cmplog on new found paths, not the initial corpus as this very likely has been done for them already.
- Keep the generated corpus, use afl-cmin and reuse it every time!
Additionally randomize the AFL++ compilation options, e.g.
- 40% for AFL_LLVM_CMPLOG
- 10% for AFL_LLVM_LAF_ALL
Also randomize the afl-fuzz runtime options, e.g.
- 65% for AFL_DISABLE_TRIM
- 50% use a dictionary generated by AFL_LLVM_DICT2FILE
- 40% use MOpt (-L 0)
- 40% for AFL_EXPAND_HAVOC_NOW
- 20% for old queue processing (-Z)
- for CMPLOG targets, 60% for -l 2, 40% for -l 3
Do not run any -M modes, just running -S modes is better for CI fuzzing. -M enables old queue handling etc. which is good for a fuzzing campaign but not good for short CI runs.

How this can look like can e.g. be seen at AFL++'s setup in Google's oss-fuzz and clusterfuzz.