libfreemkv: clip-anchored AACS unit gate + consolidate key mechanism

The AACS unit-alignment gate measured `lba % 3` against absolute disc LBA 0,
but aligned units are anchored at each clip's encrypted-region start. A clip
whose start_lba is not 3-aligned had its readable units wrongly rejected with
"Decryption failed" (the big-title-only failure on some Blu-rays). One
canonical clip-anchored helper (`aacs::is_unit_aligned`) is now the single
source of truth for the decrypt-on-read gate; both mux read paths set the
per-extent `unit_base = start_lba` via a new `SectorSource::set_unit_base`.

Also moves key *mechanism* into the library: the encrypted sample reader
(`read_encrypted_units`) and the candidate-key resolution loop
(`resolve_and_apply`) now live here, so a key source is purely a lookup.
Regression test covers a clip based at a non-3-aligned LBA.

src/sector/prefetched.rs

@@ -176,6 +176,11 @@ impl PrefetchedSectorSource {
                         return;
                     }
                     let extent = &extents[ext_idx];
+                    // AACS aligned units are anchored at THIS extent's start
+                    // LBA, so tell the decrypt-on-read source to gate relative
+                    // to it (clip-anchored), not absolute disc LBA 0. A no-op
+                    // for non-decrypting / CSS / None sources.
+                    reader.set_unit_base(extent.start_lba);
                     let remaining = extent.sector_count.saturating_sub(offset);
                     if remaining == 0 {
                         ext_idx += 1;