test: coverage-guided fuzz targets and a nightly fuzz job

rust/fuzz (cargo-fuzz, nightly, its own workspace with the same IronRDP
patches) has targets for the Telnet IAC parser, the IRC parser + state
machine + mIRC formatter, VNC framebuffer updates and decoders,
~/.ssh/config parsing and the update manifest. They reach the private
parsers through hidden entry points behind nexus-core's 'fuzzing'
feature. A nightly workflow runs each for two minutes and uploads any
crashing input. A first 45 s run of each locally found nothing.

rust/fuzz/Cargo.toml

@@ -0,0 +1,60 @@
+[package]
+name = "nexus-fuzz"
+version = "0.0.0"
+publish = false
+edition = "2024"
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+nexus-core = { path = "../core", features = ["fuzzing"] }
+
+# Its own workspace (cargo-fuzz needs nightly and its own profile), so the root's IronRDP
+# patches are repeated here; see ../vendor/README.md.
+[workspace]
+members = ["."]
+
+[patch.crates-io]
+picky = { path = "../vendor/picky" }
+sspi = { path = "../vendor/sspi" }
+ironrdp-session = { path = "../vendor/ironrdp-session" }
+
+[profile.release]
+debug = 1
+
+[[bin]]
+name = "telnet"
+path = "fuzz_targets/telnet.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "irc"
+path = "fuzz_targets/irc.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "vnc"
+path = "fuzz_targets/vnc.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "sshconfig"
+path = "fuzz_targets/sshconfig.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "updater"
+path = "fuzz_targets/updater.rs"
+test = false
+doc = false
+bench = false