Fuzz the parsers that read untrusted input

Fuzz the parsers that read untrusted input

The SSH exec line, the Git HTTP route, and the LFS packet stream are all
hand-written parsers on bytes a client controls, and each was covered only by a
table of examples someone thought to write.

Six targets, each asserting a property rather than waiting for a panic: the
command parser cannot invent bytes and its output survives being quoted back, a
route re-routes from its own parts and never names more than one path segment, a
repository argument is a name and not a path, and the packet reader's lines
survive being framed again. The seeds are the shapes the clients actually send,
so go test ./... keeps guarding them and a fuzz target costs a push nothing.

The route fuzzer found one gap on its first run: /git/.git/info/refs gave back an
empty repository name with ok set, and only the store refused it. A route that
answers ok now means a name the rest of the path applies to.

Closes #96.