Add server_mount_fuzzer for static file serving (#2666)

Fuzz Server::handle_file_request through a mount point backed by a temporary directory that holds symlinks escaping the mount root, one of them into a sibling directory sharing its name prefix. Abort if a token stored outside the root appears in a response. The seeds are based on those of #2661.

Move FuzzedStream into fuzzed_stream.h so that both server fuzzers share it, and add FuzzableServer::MarkAsRunning(), without which a server that is not listening writes no file.

test/fuzzing/corpus_mount/mount-head

@@ -0,0 +1,3 @@
+HEAD /mnt/a.txt HTTP/1.1
+Host: x
+

test/fuzzing/corpus_mount/mount-ims

@@ -0,0 +1,4 @@
+GET /mnt/a.txt HTTP/1.1
+Host: x
+If-Modified-Since: Mon, 01 Jan 2024 00:00:00 GMT
+

test/fuzzing/corpus_mount/mount-index

@@ -0,0 +1,3 @@
+GET /mnt/index.html HTTP/1.1
+Host: x
+

test/fuzzing/corpus_mount/mount-inm

@@ -0,0 +1,4 @@
+GET /mnt/index.html HTTP/1.1
+Host: x
+If-None-Match: W/"bogusetag"
+

test/fuzzing/corpus_mount/mount-linkin

@@ -0,0 +1,3 @@
+GET /mnt/link-in.txt HTTP/1.1
+Host: x
+

test/fuzzing/corpus_mount/mount-linkout

@@ -0,0 +1,3 @@
+GET /mnt/link-out.txt HTTP/1.1
+Host: x
+

test/fuzzing/corpus_mount/mount-linksibling

@@ -0,0 +1,3 @@
+GET /mnt/link-sibling.txt HTTP/1.1
+Host: x
+

test/fuzzing/corpus_mount/mount-missing

@@ -0,0 +1,3 @@
+GET /mnt/missing.txt HTTP/1.1
+Host: x
+

test/fuzzing/corpus_mount/mount-range

@@ -0,0 +1,4 @@
+GET /mnt/a.txt HTTP/1.1
+Host: x
+Range: bytes=0-3
+

test/fuzzing/corpus_mount/mount-subdir

@@ -0,0 +1,3 @@
+GET /mnt/sub/ HTTP/1.1
+Host: x
+

test/fuzzing/corpus_mount/mount-traversal

@@ -0,0 +1,3 @@
+GET /mnt/../../../../etc/passwd HTTP/1.1
+Host: x
+

test/fuzzing/corpus_mount/mount-traversal-enc

@@ -0,0 +1,3 @@
+GET /mnt/%2e%2e/secret.txt HTTP/1.1
+Host: x
+