css: relocate the CSS bus-auth into freemkv-unlock; all 3 unlockers wired

Stage 3: the CSS bus-authentication (the challenge-response that sets the
drive's ASF=1 to unlock scrambled-sector reads, plus crypt_key + the CSS
tables) moves out of libfreemkv into the self-contained src/css module, with
its own error type. CssUnlocker impls crate::Unlocker — matches DiscKind::Css,
self-guards against a non-DVD profile, runs the bus-auth, and returns an empty
Unlocked (CSS yields no VID/bus key; the keyless Stevenson descramble stays in
libfreemkv). The keyless descramble (lfsr/stevenson) is NOT moved — that's
content decryption, the consumer's job.

all_unlockers() now returns [LibreDrive, AacsCert, CssUnlocker] — the entire
unlock layer is built. libfreemkv rewires onto it in stage 4. 89 tests pass.

src/css/error.rs

@@ -0,0 +1,41 @@
+//! css's internal error for the CSS bus-auth code. Distinct from
+//! [`crate::UnlockError`] (the outcome the consumer sees).
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+#[derive(Debug, Clone)]
+pub enum Error {
+    /// The CSS bus-authentication challenge-response failed.
+    CssAuthFailed,
+    /// A SCSI transport-layer fault.
+    Scsi(crate::scsi::ScsiError),
+}
+
+impl Error {
+    /// Stable numeric code (logged). Values are local to this crate.
+    pub fn code(&self) -> u16 {
+        match self {
+            Error::CssAuthFailed => 7201,
+            Error::Scsi(_) => 7299,
+        }
+    }
+}
+
+impl From<crate::scsi::ScsiError> for Error {
+    fn from(e: crate::scsi::ScsiError) -> Self {
+        Error::Scsi(e)
+    }
+}
+
+/// CSS bus-auth either enables scrambled reads or it doesn't — any failure means
+/// "this unlocker didn't apply" (a transport fault still surfaces as Transport).
+impl From<Error> for crate::UnlockError {
+    fn from(e: Error) -> Self {
+        match e {
+            Error::Scsi(s) if s.status == crate::scsi::SCSI_STATUS_TRANSPORT_FAILURE => {
+                crate::UnlockError::Transport
+            }
+            _ => crate::UnlockError::NotApplicable,
+        }
+    }
+}