Fuzz NewManifestFromReader and cap the zstd decoder (closes #65)

FuzzNewManifestFromReader fails when the parser returns both or neither
of a manifest and an error, or allocates more than a fixed multiple of
its input and the decompressed data it may read, plus room for the
decoder's window buffers. make test runs the seed corpus; make fuzz
fuzzes for one minute.

Parser bug: MaxDecompressedSize did not bound decompression; the zstd
decoder decoded a payload under 128 KiB in full before the LimitReader
read any of it. It now decodes only what the LimitReader reads and
refuses windows over the 8 MiB mfer writes with. Seeds: a frame claiming
8 GiB, two frames together over the limit, empty frames with growing
windows.

Model: opus-5-5

mfer/deserialize.go

@@ -114,7 +114,18 @@ func (m *manifest) verifyOuterIntegrity() error {
 func (m *manifest) decompressInner() ([]byte, error) {
 	bb := bytes.NewBuffer(m.pbOuter.GetInnerMessage())
 
-	zr, err := zstd.NewReader(bb)
+	// By default the decoder decodes a payload under 128 KiB in full,
+	// each frame up to the decoder's limit, before the LimitReader below
+	// reads any of it. Decoding synchronously and never in full makes it
+	// decode only what the LimitReader asks for. It also sets aside a new
+	// buffer for each frame that asks for a larger window than the frames
+	// before it, even a frame holding no data. Refusing windows above
+	// zstdWindowSize keeps each buffer to a little over zstdWindowSize, and
+	// the buffers of frames holding no data to about 16 times it in total.
+	zr, err := zstd.NewReader(bb,
+		zstd.WithDecoderConcurrency(1),
+		zstd.WithDecodeBuffersBelow(0),
+		zstd.WithDecoderMaxWindow(zstdWindowSize))
 	if err != nil {
 		return nil, fmt.Errorf("deserialize: zstd reader: %w", err)
 	}