`cargo fuzz run` unconditionally attempts to create an artifacts directory in fuzz-dir

[apoelstra]

You can see in https://github.com/rust-fuzz/cargo-fuzz/blob/main/src/project.rs#L324-L326 (which calls artifacts_for, which calls fs::create_dir_all) that cargo fuzz run will always attempt to write to the project directory.

This is true even if you override the artifacts directory with -- -artifact_prefix=somewhere_writable/.

This means that you cannot use cargo-fuzz on a target that lives in the Nix store or anywhere else that isn't writeable.

It would be better if cargo-fuzz had first-class support for setting the artifacts directory separately from the fuzz directory.

[fitzgen]

We don't ever try and parse the extra args that are just forwarded to the libfuzzer binary, but adding a new CLI flag for specifying the artifact directory to cargo fuzz's own args seems reasonable.