keysources: sources report VID use, sample dependence and transport failures

keydb and MultiSource say whether an answer depends on samples; online
failures are classed as transport or not without erasing the
reachability slot; OnlineSource and MultiSource report uses_vid, and
partial stored keys plus a Km still report NoVid. Factory builds get a
DNS-free key-service URL check. Tests decrypt through libfreemkv's
test_util.

Cargo.toml

@@ -34,6 +34,11 @@ tracing = "0.1"
 # `set_last_decode_reachability`, for consumers' tests only (enable in dev-dependencies).
 test-hooks = []
 
+[dev-dependencies]
+# `test_util` fixtures (`decrypt_unit`, …) for this crate's tests (keys-upfront
+# KU-P1). CI resolves it through the sibling path patch.
+libfreemkv = { version = "1.7", features = ["test-util"] }
+
 [profile.release]
 lto = "thin"
 codegen-units = 1