Exclude a few lines from lcov coverage stats:

- "fail" branches in selftests
- "should never happen" errors in SSL
- cipher_xxx() failures in SSL
- some things that fail only if malloc() fails
- some things that fail only if fread/fwrite()/ftell() fails
  (after fopen() succeeded)
- some things that fail only if a parameter is invalid, but the parameter was
  actually validated earlier
- generated code in library/error.c
diff --git a/library/timing.c b/library/timing.c
index 5d8b25b..c6beff4 100644
--- a/library/timing.c
+++ b/library/timing.c
@@ -416,12 +416,12 @@
         /* For some reason on Windows it looks like alarm has an extra delay
          * (maybe related to creating a new thread). Allow some room here. */
         if( millisecs < 800 * secs || millisecs > 1200 * secs + 300 )
-        {
+        { // LCOV_EXCL_START
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
 
             return( 1 );
-        }
+        } // LCOV_EXCL_STOP
     }
 
     if( verbose != 0 )
@@ -474,12 +474,12 @@
 
 hard_test:
     if( hardfail > 1 )
-    {
+    { // LCOV_EXCL_START
         if( verbose != 0 )
             mbedtls_printf( "failed (ignored)\n" );
 
         goto hard_test_done;
-    }
+    } // LCOV_EXCL_STOP
 
     /* Get a reference ratio cycles/ms */
     millisecs = 1;
@@ -498,10 +498,10 @@
         /* Allow variation up to 20% */
         if( cycles / millisecs < ratio - ratio / 5 ||
             cycles / millisecs > ratio + ratio / 5 )
-        {
+        { // LCOV_EXCL_START
             hardfail++;
             goto hard_test;
-        }
+        } // LCOV_EXCL_STOP
     }
 
     if( verbose != 0 )