Add guava-fuzzers module with Android immutable-collection hash-flooding harness

[thinhnallf]

AndroidImmutableCollectionsHashFloodingFuzzer is a Jazzer harness that builds Android-flavor ImmutableMap/ImmutableSet/ImmutableBiMap from Aa/BB hash-colliding keys and flags quadratic equals() blow-up during construction. Uses only public construction APIs. Lives in a standalone guava-fuzzers module (not wired into the default reactor). Built by OSS-Fuzz from this checkout (google/oss-fuzz#16117); placement coordinated in #8669.

What the harness does

It builds the Android flavor of ImmutableMap, ImmutableSet and
ImmutableBiMap from keys drawn from the classic Aa/BB String-hash-collision
family and counts equals() calls during construction. When construction of N
distinct-but-hash-colliding keys degrades to super-linear equals() work
(> 1,000,000 calls), it reports a FuzzerSecurityIssueMedium
(algorithmic-complexity / hash-flooding denial of service, availability only).

The harness uses only public construction APIs — no reflection, no internals.

Module layout

guava-fuzzers/
  pom.xml
  src/main/java/AndroidImmutableCollectionsHashFloodingFuzzer.java

Why a standalone module (not wired into the reactor)

The module intentionally is not listed in the root pom <modules>, so:

• normal mvn install / Guava releases do not build it,
• the main build graph gains no dependency on Jazzer,
• nothing ships a fuzz harness to users.

OSS-Fuzz compiles the harness directly with javac against base-builder-jvm's
Jazzer jar, so it never needs the module to be part of the reactor. The
jazzer-api dependency in pom.xml is only there so the module can be compiled
locally with Maven if desired.

Happy to wire it into <modules> instead if you'd prefer it built by CI — just
let me know.

Testing

Verified end-to-end through OSS-Fuzz locally (infra/helper.py build_fuzzers +
check_build + reproduce): the target builds against the Android Guava jar and
the known hash-flooding input triggers the FuzzerSecurityIssueMedium. The
matching OSS-Fuzz build change (delete the harness copy there, repoint build.sh
to this module) is in google/oss-fuzz#16117 and will be landed after this merges.

Credit to OSS-Fuzz.