audit: module-by-module code audit fixes and test coverage

Lands the code-audit branches for aacs, css, keys, labels, udf, ifo and
dvd, bdnav/mpls/clpi, disc/bluray, extract, io, scsi, the mkv, mp4,
network and mpg muxers, the audio and video codecs, and CI. Fixes
include MKB and FMTS validation, UDF bounds, IFO fallback to the BUP,
DTS Express framing, MPEG-2 field pairing and mpg re-basing; the rest
pins existing behaviour with tests.

tests/macos_drive_tests.rs

@@ -275,8 +275,13 @@ fn rescan_returns_stable_disc_identity() {
             .map(|a| (a.disc_hash.clone(), a.mkb_version, a.volume_id))
     };
 
+    assert_eq!(
+        first_snapshot.is_some(),
+        second_snapshot.is_some(),
+        "AACS state appeared or vanished across rescans"
+    );
     let (Some(a), Some(b)) = (first_snapshot, second_snapshot) else {
-        return;
+        return; // clear/DVD disc: no AACS state to compare
     };
     assert_eq!(a.0, b.0, "disc_hash drifted across rescans");
     assert_eq!(a.1, b.1, "mkb_version drifted across rescans");