Add OSS-Fuzz integration: rules_fuzzing scaffold and CalculatorGraphConfig harness

[ricaskew]

This PR adds an initial OSS-Fuzz integration for MediaPipe, targeting the
CalculatorGraphConfig protobuf parser surface.

What this adds

Three files under mediapipe/framework/fuzz/:

• BUILD — defines a cc_fuzz_test target using rules_fuzzing v0.8.0
• calculator_graph_config_fuzz.cc — libFuzzer harness that parses raw bytes as
  CalculatorGraphConfig via ParseFromArray, then passes valid configs to
  CalculatorGraph::Initialize. Memory-safety violations in either path surface
  as AddressSanitizer crashes.
• Corpus directory placeholder (empty; OSS-Fuzz ClusterFuzz will populate it
  over time via coverage-guided mutation)

Plus additions to WORKSPACE to load rules_fuzzing v0.8.0 and its dependencies.

Build notes

The harness requires two build flags for the OSS-Fuzz base-builder environment:

• --host_cxxopt=-stdlib=libc++ and --host_linkopt=-stdlib=libc++ — the base-builder
  image ships gcc-9 on Ubuntu 20.04 whose libstdc++ lacks the C++20
  header required by MediaPipe's pinned abseil. clang-22 + libc++ is present and
  supports it cleanly.
• --define=MEDIAPIPE_DISABLE_GPU=1 — activates MediaPipe's built-in no-GPU build
  path, substituting gpu_shared_data_internal_stub for the EGL-dependent GPU
  service layer. The CalculatorGraphConfig parse surface does not require GPU.

Both flags are set in the companion OSS-Fuzz project's build.sh (PR against
google/oss-fuzz submitted separately).

Testing

The fuzzer binary was built locally using helper.py build_fuzzers and smoke-tested
via helper.py reproduce against five inputs (empty proto, minimal valid proto,
random bytes, and two structured text-format inputs). All five inputs executed
cleanly with zero AddressSanitizer findings across 100 iterations each.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[ricaskew]

Companion PR: google/oss-fuzz#15460

[ricaskew]

@googlebot I signed it!