Exclude a few lines from lcov coverage stats:

- "fail" branches in selftests
- "should never happen" errors in SSL
- cipher_xxx() failures in SSL
- some things that fail only if malloc() fails
- some things that fail only if fread/fwrite()/ftell() fails
  (after fopen() succeeded)
- some things that fail only if a parameter is invalid, but the parameter was
  actually validated earlier
- generated code in library/error.c
diff --git a/library/asn1write.c b/library/asn1write.c
index dd5a745..db0c53a 100644
--- a/library/asn1write.c
+++ b/library/asn1write.c
@@ -313,26 +313,26 @@
         // Add new entry if not present yet based on OID
         //
         if( ( cur = mbedtls_calloc( 1, sizeof(mbedtls_asn1_named_data) ) ) == NULL )
-            return( NULL );
+            return( NULL ); // LCOV_EXCL_LINE
 
         cur->oid.len = oid_len;
         cur->oid.p = mbedtls_calloc( 1, oid_len );
         if( cur->oid.p == NULL )
-        {
+        { // LCOV_EXCL_START
             mbedtls_free( cur );
             return( NULL );
-        }
+        } // LCOV_EXCL_STOP
 
         memcpy( cur->oid.p, oid, oid_len );
 
         cur->val.len = val_len;
         cur->val.p = mbedtls_calloc( 1, val_len );
         if( cur->val.p == NULL )
-        {
+        { // LCOV_EXCL_START
             mbedtls_free( cur->oid.p );
             mbedtls_free( cur );
             return( NULL );
-        }
+        } // LCOV_EXCL_STOP
 
         cur->next = *head;
         *head = cur;
@@ -347,11 +347,11 @@
         cur->val.len = val_len;
         cur->val.p = mbedtls_calloc( 1, val_len );
         if( cur->val.p == NULL )
-        {
+        { // LCOV_EXCL_START
             mbedtls_free( cur->oid.p );
             mbedtls_free( cur );
             return( NULL );
-        }
+        } // LCOV_EXCL_STOP
     }
 
     if( val != NULL )