This expands the coverage of fuzzing in `lib/web/fuzz_test.go` and includes adding seeds.
From this work a new panic was discovered where a pointer is allocated then a pointer to the pointer is passed into json.Unmarshal. It is then possible for this original pointer to remain a `nil` reference.
This pattern looks unexpected, so all cases of double pointers being passed into json.Unmarshal were changed to the more standard empty struct pointer style to avoid potential nil reference panics.
Adds `tsh bench web ssh` to allow benchmarking ssh sessions that are
created via the web api. To prevent import cycles between `lib/web`
and `lib/client` the cookie implementation in `lib/web/cookie.go`
was moved into its own package `lib/web/session`. There is curerntly
no support for SSO users - adding a local server to handle the login
was out of scope and can be added in the future.
fheinecke