Have CrashMonkey behave more like a fuzzer

[vijay03]

Have CrashMonkey run in a "fuzzer" mode where:

1. It takes as input running time T. It should terminate after this specified time.
2. It randomly picks a target workload in the configured state space (right now it explores everything)
3. It stores a persistent state with the workloads it has already explored so that it doesn't explore them in the next invocation (a bloom filter with test IDs would probably work)

[vijay03]

Check out AFL: http://lcamtuf.coredump.cx/afl/