freemkv-keysources: new crate — KeydbSource + ordered-resolve helper

The published key-source layer for libfreemkv. libfreemkv does no lookup; it
is handed a Key and derives down. This crate provides the KeySource impls that
do the lookup and hand a Key in. Applications choose and order the sources.

This first cut ships:
- KeydbSource: parses a local keydb.cfg and enumerates its material as ordered
  candidate keys (per-disc VUK/unit/media first, then the universal device-key,
  processing-key, and media-key pools). It does no derivation — the library
  walks the MKB and verifies media keys. Candidate ordering lets the library
  try each path a keydb can satisfy.
- resolve_first: tries each source's candidates in order and returns the first
  the caller's validator accepts (validate-before-return), so a stale entry
  falls through to the next source.

OnlineSource (remote key service) and MapfileSource (cached unit key) land with
the application wiring, where the sample-read and mapfile paths already live.

Cargo.toml

@@ -0,0 +1,14 @@
+[package]
+name = "freemkv-keysources"
+version = "0.27.5"
+edition = "2024"
+license = "AGPL-3.0-only"
+description = "Pluggable AACS key sources (keydb, online key service, mapfile) for libfreemkv. Each source looks a disc up and hands libfreemkv a Key; the library does all derivation."
+repository = "https://github.com/freemkv/freemkv-keysources"
+keywords = ["aacs", "blu-ray", "uhd", "decryption", "keydb"]
+categories = ["multimedia"]
+
+[dependencies]
+# Path during development; the published release pins a crates.io version. The
+# crate provides the `KeySource` trait + `Key`/`DiscInputs` types these impls fill.
+libfreemkv = { version = "0.27", path = "../libfreemkv" }