[dv] More targetted FI testing for hardened FSMs and coverage

Nobody has claimed this yet.

The current testing for hardened FSMs is standardized and just blindly injects a fault whilst some standard sequence is running.

There are a couple of issues with this:

1. The sequence may not be exploring all parts of the functionality of the block, so in particular some FSM states may simply never occur
2. On any given cycle some states may be considerably more likely than others

As a result the standardized hardened FSM tests may not stimulate state corruption in all possible states. Note that this will be not obviously picked up in coverage as the transition goes valid_state -> invalid_state -> error_state. As the 'invalid_state' is not valid it isn't part of standard automatic FSM coverage and the point of interest here involves two transitions so isn't reflected in standard automatic FSM coverage.

The current setup suffices for V2S. It demonstrates a state corruption does indeed generate the alert that it should.

For V3 we may want to be more thorough, do want to stimulate FSM state corruption in all possible states? I have a draft PR with some changes that could enable this using alert_handler for an example usage: https://github.com/lowRISC/opentitan/pull/16571

If we do want to test this we should also add coverage to ensure we've seen state corruption in all possible states.

Start by reading the current standardized hardened FSM testing setup and the draft alert_handler changes in pull request #16571. Determine whether V3 should stimulate corruption in every possible FSM state, then define coverage that confirms each state was exercised and verify the expected alert behavior.

Written by the indexing model from the issue text.