syz-manager: corpus rotation

[dvyukov]

The idea is push the fuzzer out of local maximums and help it to deal with data-driven code (where straightforward code coverage helps only once) by temporary removing part of inputs from the corpus (and associated coverage), and then letting fuzzers re-discover that coverage but potentially in a different way. After some time we should combine the removed part and the new part and minimize the corpus in some pseudo-non-deterministic way so that we get some mix of old and new inputs. Over time this should continuously rotate and refresh the corpus not letting it to stuck in local maximums, but without increasing corpus size.
The simplest strategy for selecting the part to remove is just X% of random inputs. However, a more useful strategy may be to try to free some continuous region of the state space, e.g. by removing all inputs that cover the same PC, or all inputs with a particular syscall, etc.
On implementation level the simplest strategy would be to remove part of inputs for every fuzzer/VM. I.e. each VM doesn't get some part of the corpus and the associated coverage. Then maybe the rest will even happen automatically. It may be suboptimal because VMs may be too short-lived, so that there is not enough time to refill the gap. But it still may be a good starting point.
There are multiple signals coming from different sides that this improvement should be very profitable.
Unbranched from #534