[lldb][fuzz] Allow expression fuzzer to be passed as a flag.

The expression fuzzer checks an environment variable, `LLDB_FUZZER_TARGET`, to get the fuzzer target binary. This is fine, but internally our tooling for running fuzz tests only has proper handling for flag values. It's surprisingly complicated to add support for that, and allowing it to be passed via flag seems reasonable anyway.

Reviewed By: cassanova

Differential Revision: https://reviews.llvm.org/D133546