aacs: KeyProvider abstraction + PK walker + external-UK key source

Two coherent additions to the AACS resolver:

KeyProvider abstraction (provider.rs) — key material comes from pluggable
backends; KeyDb implements it (device/processing keys, host certs,
disc-by-hash / disc-by-vid lookup) plus orphan-DK parsing. ResolveContext
takes a provider array. Adds the SD-tree PK walker
(derive_media_key_from_pk_walked) and a `probe` module (km_verifies MK
oracle, mkb_* record parsers) used for offline key verification. Cvalue
record selection prefers 0x05, falls back to 0x07.

External-UK key source — the second, mutually-exclusive key source for the
keyserver path. ScanOptions/InputOptions gain `unit_key`; when set,
resolve_encryption_static skips keydb entirely and uses the caller-supplied
Unit Key directly (KeySource::ExternalUk). Disc::read_aacs_inputs exposes a
disc's Unit_Key_RO.inf + MKB so a caller can fetch the UK out-of-band; the
library makes no network call itself.

CHANGELOG: redact test-disc title in historical notes.

tests/disc_tests.rs

@@ -135,6 +135,7 @@ fn scan_options_default() {
 fn scan_options_with_keydb() {
     let opts = ScanOptions {
         keydb_path: Some(("/tmp/KEYDB.cfg").into()),
+        ..Default::default()
     };
     assert_eq!(
         opts.keydb_path.as_ref().unwrap().to_str().unwrap(),
@@ -147,6 +148,7 @@ fn scan_options_with_keydb_pathbuf() {
     let path = std::path::PathBuf::from("/home/user/.config/aacs/KEYDB.cfg");
     let opts = ScanOptions {
         keydb_path: Some(path.clone()),
+        ..Default::default()
     };
     assert_eq!(opts.keydb_path.unwrap(), path);
 }
@@ -517,6 +519,7 @@ fn resolve_encryption_no_keydb() {
     // No keydb configured and no standard keydb on the system
     let opts = ScanOptions {
         keydb_path: Some(("/nonexistent/path/KEYDB.cfg").into()),
+        ..Default::default()
     };
     let disc = Disc::scan_image(&mut reader, 1000, &opts).unwrap();