Integrate Kani into Code Coverage CI

[Kronos3]

Looks like Kani has a code coverage feature. Our CI pipeline is currently running Kani separately from the tests though they could both merge coverage results.

[h313]

Using LLVM coverage profiles that provide execution counts during tests for Kani doesn't really make here. Kani code coverage doesn't generate a coverage profile in the same way LLVM does, since it runs via abstract interpretation instead of actually executing the program. So for each Kani proof, we'll have proofs showing what's covered and not covered in each proof harness, such as this one for proof_page_overalloc_failure:

src/util/paging.rs (util::paging::kani_proofs::proof_page_overalloc_failure)
 * 645:5 - 651:32 COVERED
 * 652:9 - 652:37 COVERED
 * 654:13 - 655:19 COVERED
 * 656:9 - 656:19 COVERED
 * 657:9 - 658:60 COVERED
 * 661:9 - 662:51 COVERED
 * 666:13 - 670:41 COVERED
 * 670:45 - 670:73 UNCOVERED
 * 674:13 - 677:16 COVERED
 * 678:13 - 678:21 UNCOVERED
 * 678:22 - 678:29 COVERED
 * 682:9 - 687:6 COVERED

This is proof-specific, and simply shows code paths not verified in each test, not including overlaps from other proofs or code paths that would be too expensive to check. I can add that output to our current formal verification CI pipeline, but we'll have to wait until SARIF output is upstreamed for us to get nicely-integrated coverage info for all of our tests.