feat(real-world-vfc-slice): add labeled OpenSSL/Firefox/Chromium/curl pair corpus

Harvest 176 isolated vuln-vs-fix functions (109 CVEs, 352 training rows)
into benchmarks/pairs/vfc with provenance and a JSONL training manifest.
Score the slice as an honesty dashboard (ousast pairs --slice vfc);
keep the pair gate on the local fixtures only.

benchmarks/pairs/vfc/curl-cve-2022-30115/fixed.c

@@ -0,0 +1,39 @@
+/* Provenance: curl/curl hsts_create (fixed).
+ * repo: curl/curl
+ * commit: fae6fea209a2d4db1582f608bd8cc8000721733a
+ * parent: ff3ee510c328db03bf171cae6179bb9463fb054f
+ * commit_url: https://github.com/curl/curl/commit/fae6fea209a2d4db1582f608bd8cc8000721733a
+ * cve: CVE-2022-30115
+ * license: curl
+ * function: hsts_create
+ * relpath: lib/hsts.c
+ */
+
+static CURLcode hsts_create(struct hsts *h,
+                            const char *hostname,
+                            bool subdomains,
+                            curl_off_t expires)
+{
+  struct stsentry *sts = hsts_entry();
+  char *duphost;
+  size_t hlen;
+  if(!sts)
+    return CURLE_OUT_OF_MEMORY;
+
+  duphost = strdup(hostname);
+  if(!duphost) {
+    free(sts);
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  hlen = strlen(duphost);
+  if(duphost[hlen - 1] == '.')
+    /* strip off trailing any dot */
+    duphost[--hlen] = 0;
+
+  sts->host = duphost;
+  sts->expires = expires;
+  sts->includeSubDomains = subdomains;
+  Curl_llist_insert_next(&h->list, h->list.tail, sts, &sts->node);
+  return CURLE_OK;
+}