fuzz: Add musig harness #36073

This PR adds a fuzz target for src/musig. Previously, the module APIs had no dedicated harness, so fail paths (empty key lists, never-generated secnonce) were underexercised.

It covers:

• MuSig2AggregatePubkeys
• MuSig2AggregatePubkeys (with key aggregation cache and optional expected aggregate)
• CreateMuSig2SyntheticXpub
• MuSig2SessionID
• Signing-shaped path:
  • CreateMuSig2Nonce
  • optionally CreateMuSig2PartialSig with a secnonce that was never generated
  • CreateMuSig2PartialSig with the generated secnonce
  • CreateMuSig2AggregateSig

The never-generated secnonce call exercises #35422. Previously, IsValid() was true as soon as a secure buffer was allocated, even before the nonce was generated. On master without that fix this arm can crash. With the fix, it returns nullopt.

<!--e57a25ab6845829454e8d69fc972939a-->

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

<!--006a51241073e994b41acfe9ec718e94-->

Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/36073.

<!--021abf342d371248e50ceaed478a90ca-->

Reviews

See the guideline and AI policy for information on the review process. A summary of reviews will appear here.

<!--5faf32d7da4f0f540f40219e4f7537a3-->

Coverage: https://nervana21.github.io/coverage/musig/ llvm-cov on 2bea78212c1047671ea93b93d345e0aea9042a69 (includes PR35422).