test: hostile-input tests for the remote-facing parsers

Seeded pseudo-random input, biased towards each parser's control bytes,
is fed to the IRC line parser and state machine (plus mIRC formatting),
Telnet IAC negotiation, VNC framebuffer updates (including ZRLE behind a
real zlib stream, with a check that the decoders are actually reached),
~/.ssh/config parsing and the update manifest. None panic, and Telnet's
pending buffer stays bounded.

These run on stable in every CI run; they are not coverage-guided, so a
cargo-fuzz setup (nightly) remains a possible follow-up.

rust/core/src/updater.rs

@@ -145,6 +145,15 @@ fn leading_int(s: Option<&&str>) -> i64 {
 #[cfg(test)]
 mod tests {
     use super::*;
+
+    #[test]
+    fn hostile_manifests_never_panic() {
+        let mut n = crate::Noise::new(0x9d);
+        for _ in 0..5000 {
+            let body = n.bytes(200, br#"{}[]":,0123456789.vlatestVersionreleaseURL"#);
+            let _ = parse_manifest(&body, "1.2.3");
+        }
+    }
     use std::io::Write;
 
     /// Serves one HTTP response on a random local port; returns its URL.