Minimised fuzz findings for the HTML pipeline (QA-5).

`python -m hoarse.tools.fuzz html` writes each finding, minimised, to its crashes
directory (by default <profile cache>/fuzz/html/crashes/) as <kind>-<hash>.html
with a .json describing it. When the defect is fixed, copy both files here;
test_fuzz_regressions.py then runs every .html file in this directory through the
same target and oracle the fuzzer used, and the fuzzer uses them as seeds.
