test: coverage-guided fuzz targets and a nightly fuzz job

rust/fuzz (cargo-fuzz, nightly, its own workspace with the same IronRDP
patches) has targets for the Telnet IAC parser, the IRC parser + state
machine + mIRC formatter, VNC framebuffer updates and decoders,
~/.ssh/config parsing and the update manifest. They reach the private
parsers through hidden entry points behind nexus-core's 'fuzzing'
feature. A nightly workflow runs each for two minutes and uploads any
crashing input. A first 45 s run of each locally found nothing.

rust/core/src/sshconfig.rs

@@ -171,6 +171,15 @@ fn is_trueish(v: &str) -> bool {
     matches!(v.to_lowercase().as_str(), "yes" | "true" | "on" | "1")
 }
 
+/// Fuzzing entry point: `data` as an ~/.ssh/config file, then into profiles.
+#[cfg(feature = "fuzzing")]
+#[doc(hidden)]
+pub fn fuzz_parse(data: &[u8]) {
+    if let Ok(blocks) = parse(&String::from_utf8_lossy(data)) {
+        let _ = to_profiles(&blocks, "f");
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;