Implement WTFuzz's no-spray technique

Replaces the heaplib spray.  The ROP chains are currently different than the ones in RopDb because they're null-byte-free.  Also, the trigger is updated.