test: hostile-input tests for the remote-facing parsers

Seeded pseudo-random input, biased towards each parser's control bytes,
is fed to the IRC line parser and state machine (plus mIRC formatting),
Telnet IAC negotiation, VNC framebuffer updates (including ZRLE behind a
real zlib stream, with a check that the decoders are actually reached),
~/.ssh/config parsing and the update manifest. None panic, and Telnet's
pending buffer stays bounded.

These run on stable in every CI run; they are not coverage-guided, so a
cargo-fuzz setup (nightly) remains a possible follow-up.

rust/core/src/sshconfig.rs

@@ -175,6 +175,23 @@ fn is_trueish(v: &str) -> bool {
 mod tests {
     use super::*;
 
+    #[test]
+    fn hostile_configs_never_panic() {
+        let mut n = crate::Noise::new(0x55c);
+        let words: &[&[u8]] =
+            &[b"Host ", b"HostName ", b"Port ", b"User ", b"ProxyJump ", b"IdentityFile ", b"Match ", b"*", b"=", b"\n", b"\"", b" ", b"a@b:22,", b"99999"];
+        for _ in 0..3000 {
+            let mut text = Vec::new();
+            for _ in 0..n.below(40) {
+                text.extend_from_slice(words[n.below(words.len())]);
+            }
+            text.extend(n.bytes(20, b" \t\n="));
+            if let Ok(blocks) = parse(&String::from_utf8_lossy(&text)) {
+                let _ = to_profiles(&blocks, "f");
+            }
+        }
+    }
+
     const TEST_CONFIG: &str = "# Test SSH config
 
 Host *