Add fuzzing audit report for Collector

[AdamKorcz]

The Opentelemetry Collector has undergone a fuzzing audit in collaboration with the CNCF and @reyang @jpkrohling @codeboten

The CNCF asks that fuzzing audit reports are stored in the respective projects repository. We thought this community repo is a great way to do that.

We have done the same for all previous CNCF fuzzing audits. Some examples are:

1. Helm (community repo): Report
2. containerd (website repo): Report
3. Envoy (core repo): Report
4. Lima (core repo): Report
5. Crossplane (core repo): Report

[reyang]

Thanks @AdamKorcz!

[reyang]

LGTM.

I suggest that we change "Opentelemetry" to "OpenTelemetry" (check https://github.com/open-telemetry/opentelemetry-specification/tree/main/specification#project-naming) in the pdf file, it'll be better if there is a way for folks to add comments in the PR if this is a markdown file, but I understand that CNCF prefers pdf.

[reyang]

@svrnm I think either this repo or https://github.com/open-telemetry/opentelemetry.io/ would work. Just want to get you informed in case you might have a strong preference.

[AdamKorcz]

LGTM.

I suggest that we change "Opentelemetry" to "OpenTelemetry" (check https://github.com/open-telemetry/opentelemetry-specification/tree/main/specification#project-naming) in the pdf file, it'll be better if there is a way for folks to add comments in the PR if this is a markdown file, but I understand that CNCF prefers pdf.

Updated in 2992691

[tigrannajaryan]

@AdamKorcz it is great to see fuzz tests added to the Collector. I have a couple quick questions:

1. Did fuzzing find any bugs so far?
2. I am unable to locate the fuzz tests in the contrib repo. I can see them in the core repo but not in the contrib. I may be looking at the wrong place.

[AdamKorcz]

@tigrannajaryan

1. There are no public bugs from the fuzzers. I can't comment on any private crashes here as they might have security implications, but feel free to message me on the CNCF slack. Edit: All emails on this list can view the private crashes: https://github.com/google/oss-fuzz/blob/81b41ad37a95577aa34ffa1f0711d467f897a619/projects/opentelemetry/project.yaml#L5.
2. The contrib fuzzers stalled in this PR: add fuzz tests to multiple receivers and processors opentelemetry-collector-contrib#35715, but they are running on OSS-Fuzz from my branch. Would be great to see them merged.

[arminru]

reports/ is a new top-level folder.
@austinlparker @svrnm is this a consistent addition to the repo or should it be included elsewhere in the existing structure?

Should we add a README.md there with a brief description/ToC, and link to it from root?

[svrnm]

@svrnm I think either this repo or open-telemetry/opentelemetry.io would work. Just want to get you informed in case you might have a strong preference.

No strong preference, both is fine with me.

What we could do, if we want to have it on the website, is pairing it with a blog post, so it is not just put somewhere, but also shared with our community and end users, similar to https://opentelemetry.io/blog/2024/security-audit-results/