Coverage guided mutation fuzzing and mutation agnostic tests

[ealmloff]

While working on #5554, most of the tests need to be rewritten and they don't cover a lot of cases we care about. This PR makes them more resilient by:

1. Asserting less about what diffing produces. Instead of asserting it produces a specific series of mutations with specific elementids change any time we change diffing, it asserts the oracle renderer produces the same dom state when moving from the previous state to this state and from an empty dom to this state
2. Switching to a more robust mutation based prop based fuzzing

This is pulled out of #5554 to shrink the diff and separate out the bugs the proptesting finds from the placeholder removal

Bug fixes:

• Fragment([]) causes the diffing engine to panic
• Template Hashing collisions
• Suspense bugs
• A bunch of dead unreachable paths in core

TODO:

• 100% diff code coverage in fuzzing
• Hook up fuzzing in ci