feat(fuzz): add egfx_multi_frame oracle and target

[Greg Lamberson (glamberson)]

Summary

• Implements target 5 of egfx: extend fuzz coverage to OpenH264-wrapper, ZGFX, multi-frame state, and encoder round-trip #1316 (egfx fuzz-coverage umbrella): the egfx_multi_frame oracle and target.
• Harness shape (per the design note posted as issuecomment-4559459227 on egfx: extend fuzz coverage to OpenH264-wrapper, ZGFX, multi-frame state, and encoder round-trip #1316): an Arbitrary-derived Vec<GfxPdu> drives a single GraphicsPipelineClient + surface-cache pair across each fuzz iteration, exposing cross-PDU state corruption that single-shot fuzzers cannot reach.
• Each PDU is encoded back to wire bytes, wrapped in a single uncompressed ZGFX segment, and fed through the client's public DvcProcessor::process entry. The harness deliberately routes through process() rather than the private handle_pdu so production traffic's full path is exercised (ZGFX-decompress + GfxPdu-decode + per-variant dispatch + state machine + surface cache).
• The uncompressed ZGFX wrap bypasses the ZGFX decoder layer (covered separately by PR feat(fuzz): add egfx_zgfx_decompress oracle and harden the ZGFX decoder against attacker-controlled input #1333) and concentrates fuzz pressure on dispatch + state machine.

Dependency

This PR depends on #1334 (Arbitrary cascade across ironrdp-egfx public PDU types). The harness uses Arbitrary-derived Vec<GfxPdu>, which requires the cascade. CI on this branch will red until #1334 merges or this branch rebases onto master post-merge. That is the correct mechanical signal of the dependency per the no-exclude-then-follow-up rule.

Validation

• cargo xtask ci clean locally on 1.89.0: fmt, lints, tests, typos, locks all green.
• check_egfx_multi_frame regression-replay test passes against the seed-empty corpus entry.
• 15-minute rigorous libFuzzer + ASan fuzz on the final SHA: 3,659,157 iterations in 901 seconds (~4,061 exec/s sustained), peak RSS 96 MB, zero panics, zero sanitizer reports, zero OOMs. Corpus grew to ~4,558 entries via coverage discovery.

What this catches

• Panics or sanitizer reports along the dispatch and state-machine path under adversarially-ordered PDU sequences.
• Inconsistent surface-cache state under attacker-controlled CreateSurface / DeleteSurface / Map* orderings.
• Corrupted frame-id state from interleaved StartFrame / EndFrame / FrameAcknowledge sequences.
• ZGFX-wrapper integration bugs separate from the standalone ZGFX coverage in egfx_zgfx_decompress (PR feat(fuzz): add egfx_zgfx_decompress oracle and harden the ZGFX decoder against attacker-controlled input #1333).

What this does NOT catch

• Cross-frame H.264 decoder state corruption. The client is constructed with h264_decoder: None, so WireToSurface1 PDUs carrying AVC payloads skip the decoder. The standalone egfx_avc420_decode (PR feat(fuzz): add egfx_avc420_decode oracle and target #1326) and egfx_avc444_decode (PR feat(fuzz): add egfx_avc444_decode oracle and target #1327) targets cover the H.264 wrapper. Wiring a real or mock H.264 decoder into this harness can be a follow-up if frame-to-frame H.264 state coverage surfaces as a gap.

Notes

• The first smoke fuzz on the in-progress harness surfaced a bit_field::set_bits panic in Timestamp::encode where derive(Arbitrary) generated u8/u16 values exceeding the encoder's 6-bit and 10-bit pack widths. The fix landed preemptively in PR feat(egfx): cascade Arbitrary derives across ironrdp-egfx public PDU types #1334 as manual Arbitrary impls for Timestamp, QuantQuality, and the Encoding bitflag (mapping each field to its wire-allowed range). That follows the sanitize via mask shape from Implement Arbitrary for more PDU structs #1122's body.
• The oracle uses as _ imports for Arbitrary and DvcProcessor per clippy's unused_trait_names lint.
• NoOpHandler is an empty struct: every GraphicsPipelineHandler method has a default impl in the trait.

Refs #1316. Depends on #1334.