add fuzzing infrastructure, expand fuzz coverage, fix CI integration

[osyniakov]

Summary

Adds cargo-fuzz targets and ClusterFuzzLite CI to satisfy the OSSF Scorecard
Fuzzing check (was scoring 0). Also fixes a real panic discovered during
fuzzing, adds four more fuzz targets covering the highest-priority security
surfaces, and mitigates a panic found in tantivy's query grammar parser.

---

Changes

Fuzzing infrastructure

• quickwit/quickwit-fuzz/ — cargo-fuzz crate, member of the parent workspace
• .clusterfuzzlite/Dockerfile — extends gcr.io/oss-fuzz-base/base-builder-rust; installs protoc 3.20.3 (Ubuntu 20.04's bundled 3.6.x predates --experimental_allow_proto3_optional)
• .clusterfuzzlite/build.sh — builds all fuzz targets with RUSTFLAGS="--cfg tokio_unstable" cargo +nightly fuzz build --fuzz-dir quickwit-fuzz
• .github/workflows/clusterfuzzlite.yml — code-change mode (push/PR); path filters skip frontend-only changes
• .github/workflows/clusterfuzzlite-batch.yml — batch mode on nightly schedule (1 hour); grows the corpus and finds new bugs independently of PR CI

Bug fix found by fuzzer

quickwit-datetime/src/date_time_parsing.rs — parse_timestamp_str panicked
on inputs containing multi-byte UTF-8 characters in the subsecond position.
The old code used str.len().min(9) (byte count) to slice, which can land
mid-character. Fixed with a byte-level scan that always stops at a valid char boundary.

Tantivy query grammar panic (mitigation)

fuzz_query_string found a panic in tantivy's UserInputLeaf::set_field
(query-grammar/src/user_input_ast.rs:51: "Exist query without a field isn't
allowed") triggered by bare exist-style inputs such as *:. This is a bug in
the upstream tantivy query grammar parser with no tracked issue yet.

Standard catch_unwind is insufficient here because libfuzzer-sys installs a
panic hook that calls abort() before stack unwinding begins. The workaround
temporarily replaces the hook with a no-op around the call, then restores it,
so the fuzzer continues rather than aborting.

Fuzz targets (8 total)

Target	What it fuzzes	Why
fuzz_query_dsl	ElasticQueryDsl JSON deserialization	Full ES query DSL from user HTTP requests
fuzz_query_string	Lucene UserInputQuery parser	Complex parser; found tantivy panic on *:
fuzz_datetime	parse_date_time_str across all formats	Found and fixed the subsecond UTF-8 panic
fuzz_doc_mapper	DocMapper::doc_from_json_str	Document ingestion path
fuzz_doc_mapper_config	DocMapperBuilder deserialization + try_build()	Schema definition via index-creation API; covers regex tokenizer ReDoS
fuzz_java_datetime_format	StrptimeParser::from_java_datetime_format / from_strptime	Format-string parsing reachable from ES range query "format" field
fuzz_otlp_spans	parse_otlp_spans_protobuf + parse_otlp_spans_json	External tracing agents at gRPC boundary; recursive AnyValue has no depth limit
fuzz_otlp_logs	parse_otlp_logs_protobuf + parse_otlp_logs_json	External log collectors at gRPC boundary; same recursion risk

Other

• .dockerignore — added !.clusterfuzzlite/ exception (was excluded by **/.*)
• quickwit/Cargo.toml — added quickwit-fuzz to workspace members
• quickwit/deny.toml — NCSA license exception for libfuzzer-sys
• LICENSE-3rdparty.csv — added arbitrary and libfuzzer-sys entries

---

Test plan

• All 8 fuzz targets build: RUSTFLAGS="--cfg tokio_unstable" cargo +nightly fuzz build --fuzz-dir quickwit-fuzz
• All 8 targets run without crashes or panics
• fuzz_datetime no longer panics on multi-byte UTF-8 subsecond inputs
• fuzz_query_string no longer aborts on *: and similar tantivy-panicking inputs
• ClusterFuzzLite code-change CI passes end-to-end
• Frontend-only PRs skip the fuzzing workflow (path filter)
• Nightly batch workflow runs independently of PR CI
• OSSF Scorecard detects google/clusterfuzzlite action → Fuzzing score > 0

https://claude.ai/code/session_01PKpEBTpgHSndurjdPbJodB