Add cargo-fuzz targets for the untrusted-input parsers and the hardening report

envelope_json, manifest_decode, item_replay, secret_key_parse, totp_parse, url_match,
with seeds. fuzz/README.md records the runs (and the server/desktop targets), the two
bugs fixed in the previous commits, dependency-policy results, CI changes and the
deploy check.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

fuzz/seeds/envelope_json/hpke

@@ -0,0 +1 @@
+{"v":1,"alg":"hpke-x25519-chacha","kid":"00000000-0000-0000-0000-000000000001","ct":"AAEC","enc":"AAEC"}

fuzz/seeds/envelope_json/xc

@@ -0,0 +1 @@
+{"v":1,"alg":"xc20p","kid":"00000000-0000-0000-0000-000000000001","n":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","ct":"AAEC"}

fuzz/seeds/item_replay/pair

@@ -0,0 +1 @@
+{"id":"00000000-0000-0000-0000-000000000001","kind":"login","title":"t","username":"u","password":"p","urls":["https://example.com"],"created_at":1,"modified_at":2,"seq":3}ÿ{"id":"00000000-0000-0000-0000-000000000001","kind":"login","title":"t","username":"u","password":"p","urls":["https://example.com"],"created_at":1,"modified_at":2,"seq":2}

fuzz/seeds/item_replay/seq_max

@@ -0,0 +1 @@
+{"id":"00000000-0000-0000-0000-000000000001","seq":18446744073709551615}˙{"seq":18446744073709551614}

fuzz/seeds/item_replay/tomb

@@ -0,0 +1 @@
+{"id":"00000000-0000-0000-0000-000000000001","seq":4,"deleted":true}ÿ{"id":"00000000-0000-0000-0000-000000000001","kind":"login","title":"t","username":"u","password":"p","urls":["https://example.com"],"created_at":1,"modified_at":2,"seq":3}

fuzz/seeds/secret_key_parse/k

@@ -0,0 +1 @@
+K1-000000-00000-00000-00000-00000-0

fuzz/seeds/totp_parse/bare

@@ -0,0 +1 @@
+







JBSW Y3DP EHPK 3PXP

fuzz/seeds/url_match/a

@@ -0,0 +1,2 @@
+https://login.example.co.uk:8443/a
+example.co.uk

fuzz/seeds/url_match/b

@@ -0,0 +1,2 @@
+http://[::1]:80/
+https://xn--bcher-kva.example/