test_models: add a test that fuzzes the tx messages

Currently we compare the car states from panda and openpilot to ensure that both parse CAN messages with the same 1) validity checks and 2) correctness/no bugs. That let us fix quite a few mismatches in behavior between the two: https://github.com/commaai/openpilot/pull/30443

Now we want to fuzz the tx messages as well, to discover bugs related to controlsAllowed in panda, and general tx safety. Here is one such mismatch that we should aim to catch: https://github.com/commaai/panda/pull/1948

See the first PR linked above for rx to know where to start. Bounty is for a merged PR that adds fuzz testing for sent openpilot messages that

1. detects mismatches in tx (sent messages) logic between openpilot and panda,
2. extensible (generic, and easy to expand with more state),
3. as performant as our current fuzzy testing, and
4. covers as many cases as possible (catches a few bugs along the way, if there are any).