Exclude a few lines from lcov coverage stats:

- "fail" branches in selftests
- "should never happen" errors in SSL
- cipher_xxx() failures in SSL
- some things that fail only if malloc() fails
- some things that fail only if fread/fwrite()/ftell() fails
  (after fopen() succeeded)
- some things that fail only if a parameter is invalid, but the parameter was
  actually validated earlier
- generated code in library/error.c
diff --git a/library/x509_crl.c b/library/x509_crl.c
index 125a773..ed5821e 100644
--- a/library/x509_crl.c
+++ b/library/x509_crl.c
@@ -240,7 +240,7 @@
             cur_entry->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl_entry ) );
 
             if( cur_entry->next == NULL )
-                return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+                return( MBEDTLS_ERR_X509_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
             cur_entry = cur_entry->next;
         }
@@ -282,10 +282,10 @@
         crl->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl ) );
 
         if( crl->next == NULL )
-        {
+        { // LCOV_EXCL_START
             mbedtls_x509_crl_free( crl );
             return( MBEDTLS_ERR_X509_ALLOC_FAILED );
-        }
+        } // LCOV_EXCL_STOP
 
         mbedtls_x509_crl_init( crl->next );
         crl = crl->next;
@@ -295,7 +295,7 @@
      * Copy raw DER-encoded CRL
      */
     if( ( p = mbedtls_calloc( 1, buflen ) ) == NULL )
-        return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+        return( MBEDTLS_ERR_X509_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
     memcpy( p, buf, buflen );