libfreemkv 1.7.4: single drive-owned AACS bus-removal point

Relocate AACS bus decryption to one spot at the bottom of the sector chain:
the Drive's SectorSource impl applies decrypt_bus_in_content (gated to
encrypted-content ranges), with the stage decided once from the unlock/
handshake result (BusStage::from_read_data_key). Remove read_data_key from
DecryptKeys::Aacs and AacsState and the two downstream decrypt_bus call sites;
every reader (key sampler, mux, unit-key validation) now sees already-de-bussed
content and never reasons about bus encryption. Add BusRemovalSectorSource
stream + tests; keep the AacsBusKeyUnavailable fail-loud gate.

Cargo.lock

@@ -221,7 +221,7 @@ dependencies = [
 
 [[package]]
 name = "freemkv-unlock"
-version = "1.7.1"
+version = "1.7.4"
 dependencies = [
  "aes",
  "base64",
@@ -317,7 +317,7 @@ checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
 [[package]]
 name = "libfreemkv"
-version = "1.7.1"
+version = "1.7.4"
 dependencies = [
  "aes",
  "base64",
@@ -839,12 +839,12 @@ dependencies = [
 
 [[patch.unused]]
 name = "freemkv-engine"
-version = "1.7.1"
+version = "1.7.4"
 
 [[patch.unused]]
 name = "freemkv-i18n"
-version = "1.7.1"
+version = "1.7.4"
 
 [[patch.unused]]
 name = "freemkv-keysources"
-version = "1.7.1"
+version = "1.7.4"