Adding syscall semantics fuzzing -- beyond thread interleavings

In its initial release, `hermit run --chaos` is focused on exploring different thread interleavings, and of course it also provides control over RNG. But thread interleavings & RNG are not the only sources of nondeterminism in Linux.

## This issue: Exercising other syscall's nondeterminism

There are many places where the Linux syscall semantics expose nondeterministic outcomes. Each of these is a candidate for fuzzing user space (i.e. acting as a Fuzzy Linux by misbehaving and exercising). This is a task to add fuzzing of these system calls as well, for a more complete and aggressive `--chaos` mode.

Here is a check list of different syscalls we plan to make fuzzy.

- [ ] read/write: how many bytes of IO are performed
- [x] futex: which threads to wake on futex_wake (--fuzz-futexes)
- [ ] mmap: address space returned (e.g. ASLR)
- [ ] all syscalls: returning extra EINTRs or other error conditions

N.B. All of them will be controlled by the same source of randomness (`--fuzz-seed`), which is separate from `--sched-seed` and `--rng-seed`, allowing these dimensions to be controlled individually. We could go further and separate seeds for each of the above if we liked.

## Out of scope

Also, there are related topics --- additional dimensions worth fuzzing in their own right for correctness stress testing -- that are beyond the scope of this issue:

- adding network delay
- dropping network connections