fuzz: make expression_evaluate reach the condition and update evaluators #859

What is wrong

Most inputs of the expression_evaluate fuzz target evaluate a condition or an update against an attribute that the item does not have, so the evaluators get little coverage.

• arb_item names each attribute with arb_string, which is up to 31 raw bytes, decoded lossily. A bare path in an expression must match [A-Za-z_][A-Za-z0-9_]* (is_ident_start and is_ident_char in the tokenizer), so a bare path seldom names an attribute of the item.
• arb_expression_maps takes each ExpressionAttributeNames value from arb_string too. A #name placeholder resolves to an attribute of the item only when that value is equal to an item attribute name.
• The expression is the rest of the input after the selector, the maps and the item. When a mutation changes a count byte in that prefix, the expression starts at a different byte.

@robinnsc measured this on #798 (comment). After a 30-second run, evaluator.rs had 42 of 835 edges covered and update_evaluator.rs had 65 of 1212. set_nested, remove_nested, evaluate_set_function (if_not_exists and list_append) and contains_check had no coverage. A 600-second run, the length of the daily run, reached 63 of 835 and 69 of 1212.

Where

• fuzz/src/lib.rs: arb_item and arb_expression_maps
• fuzz/fuzz_targets/expression_evaluate.rs: the input layout
• fuzz/seeds/expression_evaluate/: the four seeds

What to change

1. Draw item attribute names and ExpressionAttributeNames values from arb_ident, so that bare paths and #name placeholders can name attributes of the item.
2. Put the expression first, after a two-byte length, and read the selector, the maps and the item after it. A mutation of a count byte then cannot move the start of the expression.
3. Write the four seeds again in the new layout. Add seeds that use if_not_exists, list_append and contains, nested SET and REMOVE paths, BETWEEN and IN.
4. Measure the edge coverage of evaluator.rs and update_evaluator.rs with cargo fuzz coverage, before and after the change, for a 60-second run and a 600-second run. Put the numbers in the pull request.