postfix: add 6 fuzz harnesses

[tc-agent]

Expands postfix fuzzing from 2 harnesses to 8, targeting more attacker-controlled parsers in libglobal/libutil.

Baseline

Fuzz Introspector — postfix reports 7.98% line coverage (943/11,824) over the existing `fuzz_tok822` (35.33%) and `fuzz_mime` (2.5%) harnesses.

New harnesses

harness	target
`fuzz_smtpd_token`	`smtpd_token()` — SMTP command tokenizer (smtpd_token.c)
`fuzz_haproxy`	`haproxy_srvr_parse()` — HAProxy v1/v2 proxy protocol parser (haproxy_srvr.c)
`fuzz_encode`	`xtext_`, `uxtext_`, `hex_quote`/`hex_code`, `base64_code`, `base32_code` encode/decode roundtrips
`fuzz_header`	`is_header`, `header_token`, `header_opts_find`, `mac_parse`, `mac_expand`, `make_ascii_header_text`, `extpar`, `name_mask_opt`/`str_name_mask_opt`
`fuzz_addr`	`quote_822_local`/`unquote_822_local`, `quote_821_local`, `valid_hostname`/`valid_hostaddr`/`valid_ipv{4,6}_hostaddr`/`valid_hostport`/`valid_mailhost_addr`/`valid_mailhost_literal`, `dsn_valid`/`dsn_split`, `ehlo_mask`, `fold_addr`, `split_addr_internal`, `mail_addr_form_from_string`
`fuzz_cidr`	`cidr_match_parse`/`_parse_if`, `ip_match_parse`/`_execute`, `argv_split`/`_splitq`, `dict_open` for in-memory types (`static`, `inline`, `fail`) and file-backed types (`regexp`, `cidr`, `texthash`) via a tempfile, `dict_inline_open`
`fuzz_attr`	`attr_scan0`, `attr_scan_plain`, `attr_scan64` against an in-memory `VSTREAM` (`vstream_memopen`); also exercises `unescape`

`fuzz_mime` now feeds `mime_state_update` one record at a time (matching how `cleanup_message.c` drives it) instead of a single bulk call.

Layout reorganised so all harness `.c` files live under `harnesses/`. `build.sh` compiles every harness from there; the Dockerfile uses `COPY harnesses/ $SRC/harnesses/`.

A few harnesses set `var_drop_hdrs`, `var_double_bounce_sender`, `dict_allow_surrogate`, and `msg_error_limit` in `LLVMFuzzerInitialize` so calls that normally rely on `mail_conf_read()` don't `msg_panic` or `msg_fatal` on the first input.

Coverage report

Cold-start fuzzing (no seed corpus, libFuzzer generating from scratch) for 5 minutes wall-time per harness, all 9 concurrent, then a coverage build over the resulting corpus:

```
Global: lines 40.1% (5711/14230) branches ~37%
fuzz_tok822: lines 35.3% (772/2185)
fuzz_smtpd_token: lines 11.4% (202/1765)
fuzz_encode: lines 29.2% (611/2093)
fuzz_haproxy: lines 26.1% (822/3149)
fuzz_mime: lines 8.6% (975/11280)
fuzz_header: lines 12.4% (1427/11486)
fuzz_addr: lines 6.7% (738/10948)
fuzz_cidr: lines 25.9% (2179/8400)
fuzz_attr: lines 35.6% (1089/3063)
```

Global coverage rises from the Fuzz Introspector baseline of 7.98% to 40.1%. Per-harness denominators differ because each fuzzer links a different subset of libglobal/libutil; the absolute line-hit gain (943 → 5711) is the apples-to-apples comparison.

[github-actions]

Fuzzing Coverage Report

Tested: project postfix · base 374945f → head b1c7081 · 300s total fuzz budget · updated 2026-05-27 22:53 UTC · workflow run

Metric	Before	After	Delta
Static reachability	15.5% (96/621)	35.3% (243/688)	+19.9%
Line coverage	8.0% (943/11824)	34.4% (4753/13819)	+404.0%
Branch coverage	9.4% (703/7456)	32.8% (2942/8959)	+318.5%
Function coverage	9.0% (57/631)	34.5% (240/695)	+321.1%

Per-harness

Harness	Lines before	Lines after	Δ
fuzz_addr	0%	6.3% (689/10897)	new
fuzz_attr	0%	31.9% (951/2985)	new
fuzz_cidr	0%	20.9% (1735/8316)	new
fuzz_encode	0%	28.0% (577/2060)	new
fuzz_haproxy	0%	23.3% (729/3131)	new
fuzz_header	0%	11.7% (1337/11417)	new
fuzz_mime	2.5% (281/11260)	6.3% (706/11233)	+151.2%
fuzz_smtpd_token	0%	10.9% (191/1752)	new
fuzz_tok822	35.3% (772/2185)	34.9% (756/2167)	-2.1%

_{Δ = (after − before) / before, to accommodate that denominators may change. "new" when before is 0; "deleted" when after is 0.}