disc: redact Debug for AacsState/Key/HandshakeResult (test-guarded)

AacsState (public via Disc.aacs) and Key (the decrypt_with key-transport enum)
are crate-root re-exported and carried VUK/unit/read-data keys + volume id on
#[derive(Debug)]; HandshakeResult carried the VID + AACS 2.0 bus key. Manual
Debug impls print shape only, guarded by red->green tests.

src/aacs/derive.rs

@@ -595,7 +595,10 @@ mod resolve_candidate_tests {
             dk: None,
         };
         let dbg = format!("{c:?}");
-        assert!(!dbg.contains("213"), "ResolvedChain leaked unit keys: {dbg}");
+        assert!(
+            !dbg.contains("213"),
+            "ResolvedChain leaked unit keys: {dbg}"
+        );
         assert!(
             dbg.contains("unit_keys_len"),
             "ResolvedChain missing redaction: {dbg}"