disc, aacs: key files before the handshake; one whole-disc reader

Scan reads UDF and the AACS files before the drive handshake and records
a missing DVD /AACS key file instead of failing. Decryption needs an
explicit AACS unit base and refuses off-grid units; an all-broken
host-cert list is its own error (E7033). Every whole-disc and image to
ISO copy goes through one shared reader that refuses an unkeyable file
up front (E7032). HD DVD XPL tick and timecode fixes; CI action bumps.

.github/workflows/ffmpeg-validation.yml

@@ -48,7 +48,7 @@ jobs:
           cargo test --release --lib ffmpeg_ -- --ignored --nocapture 2>&1 | tee "$FREEMKV_FFMPEG_ARTIFACT_DIR/tests.log"
       - name: Upload fixtures, probes, hashes and logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ffmpeg-validation-${{ github.run_id }}-${{ github.run_attempt }}
           path: ${{ env.FREEMKV_FFMPEG_ARTIFACT_DIR }}

.github/workflows/scorecard.yml

@@ -22,6 +22,6 @@ jobs:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
-      - uses: github/codeql-action/upload-sarif@v3
+      - uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: results.sarif