feat: feature-gated Arbitrary derives + structure-aware fuzz harness (#44)

[stormer78]

Closes #44.

Adds an off-by-default arbitrary feature so downstream consumers can do structure-aware, coverage-guided fuzzing of the chain verifier, plus a workspace-detached fuzz/ crate with cargo-fuzz targets. Everything new is additive or behind the feature flag — no public-API breakage.

Arbitrary surface (feature = "arbitrary")

• Derive on the local leaf types: Version, Multibase, Witness, Witnesses, Parameters (the computed #[serde(skip)] fields are #[arbitrary(default)]), Parameters1_0, Parameters1_0Pre.
• Hand-written impls for the LogEntry types in src/arbitrary_impls.rs — their chrono::DateTime / serde_json::Value / DataIntegrityProof fields are foreign types the orphan rule won't let us derive through. state is a bounded arbitrary JSON value; proofs are built from arbitrary parts via the public DataIntegrityProof::new, so the structural proof path (shape enforcement, did:key resolution, cryptosuite gating) is reachable without valid signatures.

Note on the "wrinkles" from the issue: Arc<T> is not a blocker (arbitrary 1.x covers it); the real foreign-field blocker was serde_json::Value on state, handled by the bounded generator.

Verifier assembly

• DIDWebVHState::from_log_entries(Vec<LogEntry>) — the documented, filesystem-free way to drive validate() from an in-memory chain (useful beyond fuzzing). version_number is best-effort so deliberately broken chains still reach the verifier.

Fuzzing (fuzz/)

• Targets: parameters_validate, logentry_deserialize, chain_validate, proof_verify (the proof-verification path).
• fuzz/ has its own empty [workspace] table → normal cargo build/test/clippy never compile it; nightly + libfuzzer stay out of default CI.
• New Fuzz workflow runs only on workflow_dispatch + weekly cron.
• Smoke-run locally: ~6M total executions across all four targets, no crashes.

Dependency refresh (required to compile cleanly)

• cargo update; affinidi-data-integrity 0.7.1 → 0.7.6 made DataIntegrityProof #[non_exhaustive], so the existing test/test-utils struct literals are converted to DataIntegrityProof::new().

Housekeeping

• Version bumped 0.5.4 → 0.5.5; CHANGELOG + README updated (new Feature Flags row + "Fuzzing" section).

Verification

• cargo fmt -- --check ✅
• cargo clippy --all-features --tests --examples -- -D warnings ✅
• cargo test --all-features ✅ (435 + integration, 0 failed) and default cargo test ✅