[dev.fuzz] internal/fuzz: implement coverage and trace instrumentation
This CL makes two main changes to allow internal/fuzz to support
-d=libfuzzer instrumentation:
1. It extends cmd/link to define _counters and _ecounters symbols so
internal/fuzz can find the coverage counters.
2. It adds "trace" stub functions that implement the ABI expected by
cmd/compile for comparison instrumentation.
N.B., that -tags=libfuzzer should *not* be set, so that
internal/fuzz's trace routines will be used instead of runtime's
libfuzzer trampolines.
Also, the current implementation doesn't support multi-module builds
(i.e., compiling a Go program that spans multiple .so/.dll files).
Presumably this isn't an issue, since "go test -fuzz" will need to
recompile the binary with instrumentation anyway so it can make sure
to always use a single-module build. But we can revisit this if
necessary.