HTML attribute fuzzer

This is a first step toward a fuzzer for all Blink's HTML attributes,
which is a notable gap in our coverage-guided fuzzer report (for
instance
https://analysis.chromium.org/coverage/p/chromium/file?host=chromium.googlesource.com&project=chromium/src&ref=refs/heads/main&revision=e3c6b61f35330afb377a2086ffadc3d7e2321d8c&path=//third_party/blink/renderer/core/html/html_anchor_element.cc&platform=fuzz&test_suite_type=any&modifier_id=0#348
).

To run it:
ASAN_OPTIONS=detect_odr_violation=0 out/libfuzzer/blink_unittests_BlinkAttributeFuzzTestFixture_NoElementAttributeCrashes_fuzzer

This may be slightly duplicative of some other fuzzers (e.g. blackbox
fuzzers, and the DomatoLPM fuzzer under development) but as a simple
coverage guided fuzzer in this area it's likely to explore this code
more rapidly than most other approaches.

Cq-Include-Trybots: luci.chromium.try:linux-centipede-asan-rel
Cq-Include-Trybots: luci.chromium.try:linux-libfuzzer-asan-rel
Cq-Include-Trybots: luci.chromium.try:win-libfuzzer-asan-rel
Bug: 40947696, 40286211
Change-Id: Id2f61ab4d9d9c59b877e3760620ed059d2a4386f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5388376
Reviewed-by: Titouan Rigoudy <titouan@chromium.org>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Commit-Queue: Adrian Taylor <adetaylor@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1393546}