Exclude a few lines from lcov coverage stats:

- "fail" branches in selftests
- "should never happen" errors in SSL
- cipher_xxx() failures in SSL
- some things that fail only if malloc() fails
- some things that fail only if fread/fwrite()/ftell() fails
  (after fopen() succeeded)
- some things that fail only if a parameter is invalid, but the parameter was
  actually validated earlier
- generated code in library/error.c
diff --git a/library/x509_crt.c b/library/x509_crt.c
index f6879dd..a828a86 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -489,7 +489,7 @@
 
             if( cur->next == NULL )
                 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS +
-                        MBEDTLS_ERR_ASN1_ALLOC_FAILED );
+                        MBEDTLS_ERR_ASN1_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
             cur = cur->next;
         }
@@ -680,7 +680,7 @@
 
     p = mbedtls_calloc( 1, len = buflen );
     if( p == NULL )
-        return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+        return( MBEDTLS_ERR_X509_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
     memcpy( p, buf, buflen );
 
@@ -936,7 +936,7 @@
         crt->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
 
         if( crt->next == NULL )
-            return( MBEDTLS_ERR_X509_ALLOC_FAILED );
+            return( MBEDTLS_ERR_X509_ALLOC_FAILED ); // LCOV_EXCL_LINE
 
         prev = crt;
         mbedtls_x509_crt_init( crt->next );
@@ -1046,7 +1046,7 @@
                  * Quit parsing on a memory error
                  */
                 if( ret == MBEDTLS_ERR_X509_ALLOC_FAILED )
-                    return( ret );
+                    return( ret ); // LCOV_EXCL_LINE
 
                 if( first_error == 0 )
                     first_error = ret;