Exclude a few lines from lcov coverage stats:

- "fail" branches in selftests
- "should never happen" errors in SSL
- cipher_xxx() failures in SSL
- some things that fail only if malloc() fails
- some things that fail only if fread/fwrite()/ftell() fails
  (after fopen() succeeded)
- some things that fail only if a parameter is invalid, but the parameter was
  actually validated earlier
- generated code in library/error.c
diff --git a/library/dhm.c b/library/dhm.c
index 0f4d316..7ed56a5 100644
--- a/library/dhm.c
+++ b/library/dhm.c
@@ -521,27 +521,27 @@
 
     fseek( f, 0, SEEK_END );
     if( ( size = ftell( f ) ) == -1 )
-    {
+    { // LCOV_EXCL_START
         fclose( f );
         return( MBEDTLS_ERR_DHM_FILE_IO_ERROR );
-    }
+    } // LCOV_EXCL_STOP
     fseek( f, 0, SEEK_SET );
 
     *n = (size_t) size;
 
     if( *n + 1 == 0 ||
         ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
-    {
+    { // LCOV_EXCL_START
         fclose( f );
         return( MBEDTLS_ERR_DHM_ALLOC_FAILED );
-    }
+    } // LCOV_EXCL_STOP
 
     if( fread( *buf, 1, *n, f ) != *n )
-    {
+    { // LCOV_EXCL_START
         fclose( f );
         mbedtls_free( *buf );
         return( MBEDTLS_ERR_DHM_FILE_IO_ERROR );
-    }
+    } // LCOV_EXCL_STOP
 
     fclose( f );
 
@@ -602,13 +602,13 @@
     if( ( ret = mbedtls_dhm_parse_dhm( &dhm,
                     (const unsigned char *) mbedtls_test_dhm_params,
                     mbedtls_test_dhm_params_len ) ) != 0 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "failed\n" );
 
         ret = 1;
         goto exit;
-    }
+    } // LCOV_EXCL_STOP
 
     if( verbose != 0 )
         mbedtls_printf( "passed\n\n" );