test(scrape): add fuzz targets for the scrape path

[vslpsl]

What

Fuzz targets for the scrape ingestion path — the exposition-format parsers, hashdex reuse, a differential target against upstream's Go textparse, the HTTP response reader, and target construction from discovered labels.

Target	Package	Covers
FuzzPrometheusScraperHashdexParse	pp/go/cppbridge	C++ Prometheus text parser invariants
FuzzOpenMetricsScraperHashdexParse	pp/go/cppbridge	Same, OpenMetrics
FuzzScraperHashdexReuse	pp/go/cppbridge	Hashdex reuse across scrapes matches a fresh one
FuzzScraperHashdexAgainstTextparse	pp/go/cppbridge	Differential: whatever upstream's Go parser accepts, the C++ parser must accept too
FuzzReadResponse	pp-pkg/scrape	gzip, body_size_limit, pooled readers
FuzzTargetsFromGroup	pp-pkg/scrape	Relabeling, address handling, __sample_limit__

Seed corpora and the libFuzzer dictionary are shared through util/fuzzing/scrapecorpus (stdlib-only, so it doesn't drag PromQL test machinery into the cgo test binary).

What this PR does not include

No production code changes, docs, CI workflow, or regression tests — just the fuzz targets and corpus, by request. Running these targets with -fuzz can rediscover real issues found during development:

• a reused C++ scraper kept the previous parse's samples/metadata after a body with invalid UTF-8 (state reset ran after the UTF-8 check instead of before)
• a negative __sample_limit__ annotation wrapped to unsigned on the C++ side and silently disabled the configured sample limit

These are left for a follow-up PR with the actual fixes.

How to run

From the Dockerfile.ci image (targets link against the C++ bindings):

docker run --rm -it -v "$PWD":/workspace -w /workspace \
  -e CGO_ENABLED=1 -e CGO_CFLAGS="-Wno-error -I/usr/include" -e CGO_LDFLAGS="-L/usr/lib/" \
  prompp-build bash -c '
    git config --global --add safe.directory /workspace
    cd pp && make build-entrypoint && cd ..
    go test -race -run=FuzzReadResponse -fuzz="^FuzzReadResponse$" -fuzztime=10m ./pp-pkg/scrape/
  '

Every target also runs as an ordinary test over its seed corpus, so go test ./pp/go/cppbridge/... ./pp-pkg/scrape/... exercises the seeds without -fuzz.

Made with Cursor