AACS 2.0: P-256 curve, SHA-256 ECDSA, bus decryption pipeline

- Added P-256/secp256r1 curve constants
- Added AACS 2.0 LA public key for drive cert verification
- Implemented P-256 ECDSA sign/verify (SHA-256)
- Implemented P-256 ECDH for bus key derivation
- Added aacs2_authenticate() entry point (falls back to AACS 1.0)
- Extended HostCert with optional v2 credentials
- Added sha2 dependency
- Added keydb updater (HTTP GET via raw TCP, zip/gzip extraction)
- 4 new P-256 tests: generator, order, ECDSA, ECDH — all passing
- 32 total tests passing

src/disc.rs

@@ -519,8 +519,12 @@ impl Disc {
         if !device_path.is_empty() {
             if let Ok(mut aacs_session) = DriveSession::open_no_unlock(std::path::Path::new(&device_path)) {
                 if let Ok(hc) = keydb.host_cert.as_ref().ok_or(()) {
-                    if let Ok(mut auth) = handshake::aacs_authenticate(
-                        &mut aacs_session, &hc.private_key, &hc.certificate,
+                    if let Ok(mut auth) = handshake::aacs2_authenticate(
+                        &mut aacs_session,
+                        &hc.private_key,
+                        &hc.certificate,
+                        hc.private_key_v2.as_ref(),
+                        hc.certificate_v2.as_deref(),
                     ) {
                         vid = handshake::read_volume_id(&mut aacs_session, &mut auth).ok();
                         read_data_key = handshake::read_data_keys(&mut aacs_session, &mut auth)