Fast pass fuzzing

[kripken]

Adds --fuzz-passes to wasm-opt, which makes it pick random passes to run on the random wasm it generates, and sees if they break anything. Before I used some python to pick the passes, but doing this in wasm-opt is a lot faster (like an order of magnitude in afl-fuzz).

Amusingly, when fuzzing with this the map density passes 70%, leading to this afl-fuzz warning:

The fuzzer will flag high percentages [of map density] in red.
Chances are, you will never see that unless you're fuzzing
extremely hairy software (say, v8, perl, ffmpeg).

So I guess we're in good company? ;)

[kripken]

This found a few issues so it seems useful, and looks like no concerns, merging.