update bnf to 0.6 (copy #8864)

[mergify]

Closes #8864

Summary

• Upgrade bnf to 0.6 and remove the rand version pin that was required until bnf 0.6 (see #7897).
• Use coverage-guided grammar generation in the connector_selection_parse fuzz target: switch to bnf's CoverageGuided strategy and run multiple generations per fuzz input so we exercise more grammar productions per seed.

Motivation

• bnf 0.6 re-exports rand and uses rand 0.9, so the fuzz crate no longer needs a pinned rand dependency.
• The connector_selection_parse target previously used a single grammar generation per input; CoverageGuided only helps when the same strategy is reused across generations. Running several generations per input (same seed, same strategy) lets the strategy prefer previously unused productions, improving grammar coverage for the JSON selection parser fuzz run.

Changes

• fuzz/Cargo.toml: bump bnf from 0.5.0 to 0.6, remove rand = "=0.8.5" and the comment about bnf PR fix(deps): update rust crate anyhow to 1.0.48 #175.
• fuzz/fuzz_targets/connector_selection_parse.rs: use bnf::CoverageGuided and bnf::rand (no direct rand dep); generate up to 8 selections per fuzz input via generate_seeded_with_strategy and parse each; keep Corpus::Reject when no generation succeeds (e.g. non-terminating expansion).

---

---

Checklist

Complete the checklist (and note appropriate exceptions) before the PR is marked ready-for-review.

• PR description explains the motivation for the change and relevant context for reviewing
• PR description links appropriate GitHub/Jira tickets (creating when necessary)
• Changeset is included for user-facing changes
• Changes are compatible¹
• Documentation² completed
• Performance impact assessed and acceptable
• Metrics and logs are added³ and documented
• Tests added and passing⁴
  • Unit tests
  • Integration tests
  • Manual tests, as necessary

Exceptions

• Changeset: Not included; changes are limited to the fuzz crate and do not affect router behavior or user-facing APIs.
• Documentation: N/A; no configuration or user-facing behavior changed.
• Metrics and logs: N/A; no new observability added.
• Tests: No new unit or integration tests. Verified with cargo check -p router-fuzz and by running the connector_selection_parse fuzz target.

Notes

---

This is an automatic copy of pull request #8864 done by [Mergify](https://mergify.com).

Footnotes

1. It may be appropriate to bring upcoming changes to the attention of other (impacted) groups. Please endeavour to do this before seeking PR approval. The mechanism for doing this will vary considerably, so use your judgement as to how and when to do this. ↩

2. Configuration is an important part of many changes. Where applicable please try to document configuration examples. ↩

3. A lot of (if not most) features benefit from built-in observability and debug-level logs. Please read this guidance on metrics best-practices. ↩

4. Tick whichever testing boxes are applicable. If you are adding Manual Tests, please document the manual testing (extensively) in the Exceptions. ↩

[goto-bus-stop]

Approved in #8864.