gs1-syntax-engine: initial integration

[terryburton]

The Syntax Engine is the reference implementation for processing GS1 barcode
data: Application Identifier element strings (bracketed and unbracketed), GS1
Digital Link URIs, and raw scan data from GS1 symbologies. It is part of the
GS1 Barcode Syntax Resource, the suite of tools GS1 provides for implementing
its standards.

https://www.gs1.org/standards/gs1-barcodes/gs1-barcode-syntax-resource

Why it is worth fuzzing:

• It is a parser for globally standardised supply-chain identifiers, and is
  intended for integration into software that processes barcode data from
  untrusted sources — retail point of sale, logistics scanning, healthcare
  traceability, and regulatory verification systems.
• It is distributed well beyond the C library: official bindings for C#/.NET,
  Java (JNI), Swift and JavaScript/WebAssembly, plus an npm package, an
  Android library and an iOS package. A memory-safety defect in the C core is
  reachable from all of them.
• As the reference implementation, its behaviour is what other implementers
  compare against, so defects here propagate.

What is being integrated:

Five libFuzzer targets that already exist upstream and are maintained
alongside the code they exercise:

Target	Entry point
gs1encoders-fuzzer-ais	AI element string parsing
gs1encoders-fuzzer-data	Raw AI data string parsing
gs1encoders-fuzzer-dl	GS1 Digital Link URI parsing and generation
gs1encoders-fuzzer-scandata	Barcode scan data across symbologies
gs1encoders-fuzzer-syn	Hostile GS1 Barcode Syntax Dictionary files

Beyond crash-freedom, the harnesses assert semantic invariants: the dl target
round-trips parsed data back through the parser and asserts stability, and the
syn target asserts structural contracts on every table entry
produced from hostile input.

The build script lives upstream at maintenance/ossfuzz/build.sh; build.sh
here delegates to it so that changes to the source layout or the fuzzer set do
not need a PR against this repository. It emits per-target seed corpora (the
Syntax Dictionary itself for the syn target, string literals extracted from
the test suite and parsers for the others) and .options files capping
generated input at the largest length the harnesses accept.

The library has no third-party runtime dependencies, so MemorySanitizer is
viable; it is enabled as experimental for the initial integration.

I am a maintainer of the project.

[github-actions]

terryburton is integrating a new project:
- Main repo: https://github.com/gs1/gs1-syntax-engine.git
- Criticality score: 0.33161