CFG improvements about fuzz-introspector HOT 2 OPEN

An example case in the form of systemd where some parts of the project forces a build with bfd, i.e. is incompatible with gold and LTO, which means fuzz-introspector won't work: google/oss-fuzz#7573 (comment)

from fuzz-introspector.

One solution to enhance statically extracted Call Graph specifcally for indirect calls is using this feature of sancov:

With an additional ...=trace-pc,indirect-calls flag __sanitizer_cov_trace_pc_indirect(void *callee) will be inserted on every indirect call.

What we should do is building the fuzz target with those flags and implement __sanitizer_cov_trace_pc_indirect() to capture the actuall callee of the indirect call at the run-time. Then via running the instrumented fuzz target with the available corpus we can collect the indirect calls callees.

from fuzz-introspector.