Add grant parsing fuzz test

[johanbrandhorst]

Adds fuzz tests for the grant parser. Running this I found two issues:

• We were not consistently handling invalid unicode. I fixed this by always replacing invalid unicode in inputs with the unicode replacement handler. This is what marshaling to JSON already does.
• We were not handling empty output fields consistently. output_fields=, was allowed while output_fields= was not. Now the latter is allowed and the former is equal to the latter.

[johanbrandhorst]

Fuzzing did discover a fun one: output_fields=, was allowed.

[jefferai]

Fuzzing did discover a fun one: output_fields=, was allowed.

Correct! This is allowed!

[johanbrandhorst]

Fuzzing did discover a fun one: output_fields=, was allowed.

Correct! This is allowed!

Interesting! The error happened because this input creates a canonical string of output_fields=, which when roundtripped back into the parser is not allowed. Should the canonical string of output_fields=, be output_fields=,?

[johanbrandhorst]

I removed the "fix" for output_fields=, and started allowing output_fields=, with the same behavior. This means that the input output_fields=, safely roundtrips to output_fields=, which presumably means "no output fields are allowed".

[jefferai]

Yes, I think in general any trailing comma on a string should be stripped for parsing and for the canonical representation

[jefferai]

Meant to follow up on this: yes, output_fields= means "no output fields allowed". While it doesn't have a lot of use cases -- and if it's confusing we could think about taking it out -- the idea is for things like services where you want to perform an action periodically and the only thing you need or want the service to know about is the HTTP status code, and don't want to divulge any other data.

[johanbrandhorst]

Meant to follow up on this: yes, output_fields= means "no output fields allowed". While it doesn't have a lot of use cases -- and if it's confusing we could think about taking it out -- the idea is for things like services where you want to perform an action periodically and the only thing you need or want the service to know about is the HTTP status code, and don't want to divulge any other data.

OK so it sounds like the only real change here (accepting output_fields=) is what we want, should we merge this then?