Exclude a few lines from lcov coverage stats:

- "fail" branches in selftests
- "should never happen" errors in SSL
- cipher_xxx() failures in SSL
- some things that fail only if malloc() fails
- some things that fail only if fread/fwrite()/ftell() fails
  (after fopen() succeeded)
- some things that fail only if a parameter is invalid, but the parameter was
  actually validated earlier
- generated code in library/error.c
diff --git a/library/ssl_cache.c b/library/ssl_cache.c
index 711bc53..6456965 100644
--- a/library/ssl_cache.c
+++ b/library/ssl_cache.c
@@ -104,10 +104,10 @@
         {
             if( ( session->peer_cert = mbedtls_calloc( 1,
                                  sizeof(mbedtls_x509_crt) ) ) == NULL )
-            {
+            { // LCOV_EXCL_START
                 ret = 1;
                 goto exit;
-            }
+            } // LCOV_EXCL_STOP
 
             mbedtls_x509_crt_init( session->peer_cert );
             if( mbedtls_x509_crt_parse( session->peer_cert, entry->peer_cert.p,
@@ -223,10 +223,10 @@
              */
             cur = mbedtls_calloc( 1, sizeof(mbedtls_ssl_cache_entry) );
             if( cur == NULL )
-            {
+            { // LCOV_EXCL_START
                 ret = 1;
                 goto exit;
-            }
+            } // LCOV_EXCL_STOP
 
             if( prv == NULL )
                 cache->chain = cur;
@@ -258,10 +258,10 @@
     {
         cur->peer_cert.p = mbedtls_calloc( 1, session->peer_cert->raw.len );
         if( cur->peer_cert.p == NULL )
-        {
+        { // LCOV_EXCL_START
             ret = 1;
             goto exit;
-        }
+        } // LCOV_EXCL_STOP
 
         memcpy( cur->peer_cert.p, session->peer_cert->raw.p,
                 session->peer_cert->raw.len );