fuzz: give sigv4_verify fixed header names with fuzzed values #860

What is wrong

The sigv4_verify fuzz target reads each request header from a name:value line of the input, and the fuzzer chooses every byte of the name. Much of the coverage of the target is in the header name parser of the http crate, and little is in the canonical request and signature checks of crates/auth/src/sigv4/verify.rs. @robinnsc measured 759 of 1543 covered edges in the http crate on #798 (comment).

The signature covers the headers that the SignedHeaders part of the Authorization header names. A mutated input seldom names a header with the same bytes, so most inputs fail before the signature check.

The sigv4_timestamp target had the same problem, and a separate change fixes it: that target now fuzzes only the x-amz-date value.

Where

• fuzz/fuzz_targets/sigv4_verify.rs: the input layout
• fuzz/src/lib.rs: request_from_lines
• fuzz/seeds/sigv4_verify/signed_request

What to change

1. Choose each header name with a selector byte from a fixed list: host, x-amz-date, x-amz-target, content-type, x-amz-content-sha256, x-amz-security-token, and one name that the fuzzer writes. Fuzz only the value. Keep the Authorization line and the body as they are.
2. Write the seed again in the new layout, with a valid signature that a program outside the Rust code computes, as for the present seed.
3. Check that the seed returns Ok(()) from verify_signature, and that it fails with one body byte changed.
4. Compare the covered edges in verify.rs before and after the change, and put the numbers in the pull request.