Heuristics to filter / prioritize crashes

[oliverchang]

To aid in filtering down the number of potential false positive crashes reported to maintainers, we can applying the following prioritization rules:

• Crash with LLVMFuzzerTestOneInput as the top frame: Most likely false positive.
• Crash discovered without any / much coverage growth: likely false positive. Note though, there can be exceptions here if there is a particular low hanging fruit in the function being fuzzed that's very easy to find.
• Crash discovered with zero coverage diff or edge coverage: most likely false positive.
• Use after frees where the free happens in LLVMFuzzerTestOneInput.
• null derefs, FPEs, aborts, C++ exceptions, are likely uninteresting to report.

Additionally, we need a way to detect cases of #164 and #7.

[DonggeLiu]

The first one is addressed:

• Crash with LLVMFuzzerTestOneInput as the top frame: https://github.com/google/oss-fuzz-gen/pull/187/files#diff-cc74274207721385b333564f0db8639bd5acf97ee8830228c2b7eccec65e23c1R311

Will address the others soon.