openvpn: add fuzz_options harness for read_config_string and apply_push_options

[tc-agent]

Summary

Adds a new fuzz_options harness that exercises two real attacker-controlled
entry points in OpenVPN's options layer:

• read_config_string() / add_option() — the config-file parser
  (~9 k-line dispatch chain in options.c).
• apply_push_options() — server PUSH_REPLY processing.

Each fuzz iteration also runs options_postprocess(), setenv_settings(), and
show_settings(), so coverage extends into mutation/validation logic.

[github-actions]

Fuzzing Coverage Report

Tested: project openvpn · base 766921e → head 0ae18c0 · 300s total fuzz budget · updated 2026-05-27 20:13 UTC · workflow run

Metric	Before	After	Delta
Static reachability	>45m	>45m	—
Line coverage	9.8% (4934/50223)	19.5% (9828/50307)	+99.2%
Branch coverage	5.1% (1701/33117)	18.4% (6083/33137)	+257.6%
Function coverage	14.6% (330/2268)	22.3% (506/2273)	+53.3%

Per-harness

Harness	Lines before	Lines after	Δ
fuzz_base64	62.3% (137/220)	62.3% (137/220)	+0.0%
fuzz_buffer	1.9% (949/49602)	1.9% (949/49604)	+0.0%
fuzz_dhcp	0.2% (90/49389)	0.2% (90/49391)	+0.0%
fuzz_list	0.9% (450/49477)	0.9% (450/49479)	+0.0%
fuzz_misc	0.8% (393/49412)	0.8% (393/49414)	+0.0%
fuzz_mroute	1.2% (608/49414)	1.2% (608/49416)	+0.0%
fuzz_options	0%	12.9% (6357/49458)	new
fuzz_packet_id	1.1% (538/49442)	1.1% (538/49444)	+0.0%
fuzz_proxy	2.2% (1085/49464)	1.9% (928/49466)	-14.5%
fuzz_route	3.8% (1876/49534)	3.8% (1876/49536)	+0.0%
fuzz_verify_cert	1.0% (508/49467)	1.0% (502/49469)	-1.2%

_{Δ = (after − before) / before, to accommodate that denominators may change. "new" when before is 0; "deleted" when after is 0.}