Add a test-case without a `main:` label to trigger a segfault

The segfault happens in carp_vm_make() due a NULL pointer dereference
of `res`.

This also adds a directory called `fuzz` which isn't very well named,
but maybe one day we can start fuzz-testing Carp. Until then, we can
use this directory to hold use cases that break Carp, and one day a
test-suite that makes sure each commit doesn't break any of them.
Clean up file_read() and avoid a full memset() of contents