Generic uni tests for fuzzer reachability

[LCBH]

Goal: have a couple of reachability tests of the form

Can the fuzzer reach a state satisfying predicate P within one mutational stage (with a couple of mutations)?

Examples of predicates are:

• specific sub-term under an encryption
• introduce a specific function symbol in a specific recipe
• successful payloads replacement under encryption for the Term with payloads #280
• etc.

This would also be useful to (in)validate some assumptions we often rely on such as "there is a non-negligeable probability that those 2/3/4 mutations will be jointy applied in one stage".

[maxammann]

Do you envision here more unit/benchmark tests that tests the mutations in isolation, or something more E2E?

I think we want to have some E2E tests at some point to confirm that tlspuffin is still working.

An idea here: We do not test the mutations in isolation and write a dummy PUT that crashes when seeing specific messages. That dummy PUT could be quite simple, but likely would need some decoding and decryption capabilities. Unless we design a non-encrypted and simple protocol that just demos some mutations.