Advanced fuzzing with `arbitrary`

We want to move from shallow “bytes-only” fuzzing to **advanced/structured fuzzing** using `arbitrary`-generated PDUs and stronger oracles (round-trip, invariants, state-machine checks). This is expected to find many small problems which we will fix incrementally.

This issue replaces the earlier discussion-only issue (#365).

## Goals
- Restore and support `arbitrary` feature across the relevant crates
- Expand `Arbitrary` coverage over key PDU structs
- Add higher-signal fuzzing harnesses/oracles (round-trip, decoder invariants, connector state-machine)
- Improve CI compilation verification over feature sets (`arbitrary`, `std` vs `no_std`, etc.)

## Non-goals (for initial rollout)
- Perfect coverage of all PDUs on day 1
- Eliminating all findings before merging the harness improvements

## Roadmap

1. Fix the `arbitrary` feature flag so it compiles reliably, and provide `arbitrary::Arbitrary` for as many PDU structs as possible.
2. Update CI so we also test/compile with `arbitrary` enabled (and more generally improve compilation verification with feature sets: likely using `cargo-hack`, or a carefully chosen feature matrix; also important: `std` enabled vs `std` disabled for crates that support `no_std`/`alloc`).
3. Craft better fuzzing harnesses (verify more invariants, check state machines, etc.). This is the “advanced fuzzing” part: not just “decode bytes”, but “generate _structured_ inputs and assert protocol invariants”.
4. Fix low-hanging fruit issues found with shallow fuzzing.
5. Fix other findings as they arise from the weekly long runs.

### Technical blueprint

We use a pattern like:

- `fuzz/` (cargo-fuzz workspace)
- `fuzz/fuzz_targets/*.rs` are tiny wrappers: they just call an oracle.
- `crates/ironrdp-fuzzing/`
- `src/generators/*` — *structured inputs* (implement `Arbitrary`)
- `src/oracles/*` — invariants + assertions (panic == bug)
- `crates/ironrdp-testsuite-core/test_data/fuzz_regression//*.bin` with regression tests that replay minimized crashers.

This keeps the fuzz targets extremely small and all logic testable/re-usable outside libFuzzer.

- #1121
- #1122
- #1123
- #1124

### Local dev notes

* `cargo xtask fuzz install`
* `cargo xtask fuzz run `

## Notes / links
- Prior discussion: #365
- Existing fuzz scaffold: `fuzz/` + `crates/ironrdp-fuzzing/` + `cargo xtask fuzz ...`

Start by reading the existing fuzz scaffold in fuzz/, crates/ironrdp-fuzzing/, and the cargo xtask fuzz commands. Review fuzz/fuzz_targets/*.rs, generators, oracles, and the feature configuration before choosing one roadmap step. Done means the selected arbitrary support, oracle, harness, or CI feature compiles and has runnable or regression-tested coverage.

Written by the indexing model from the issue text.