Add OnlineSource and MapfileSource

OnlineSource: the remote key-service client (moved out of autorip), posting the
disc's Unit_Key_RO.inf + MKB + Volume ID + encrypted content samples to the
service and returning the resolved unit key as a terminal Key::Unit candidate.
Kept out of libfreemkv so the library stays network-free. Source-internal
failures (unreachable / status / parse) are logged and surface as "no
candidate" so the next source is tried.

MapfileSource: reads a rip mapfile's persisted unit keys (the resume / deferred-
mux fast path) and offers them as a Key::Unit candidate. Keyed by mapfile path.

DiscInputs gained an app-populated `samples` field for sources that validate
against ciphertext server-side (OnlineSource); local sources ignore it.

Cargo.toml

@@ -12,3 +12,8 @@ categories = ["multimedia"]
 # Path during development; the published release pins a crates.io version. The
 # crate provides the `KeySource` trait + `Key`/`DiscInputs` types these impls fill.
 libfreemkv = { version = "0.27", path = "../libfreemkv" }
+# OnlineSource: POST disc inputs + samples to a key service over HTTP.
+ureq = { version = "2", features = ["json"] }
+serde_json = "1"
+base64 = "0.22"
+tracing = "0.1"