aacs: validate a resolved key against content before applying it

decrypt_with now takes the disc's encrypted content samples and, after
deriving the candidate unit keys, confirms at least one de-scrambles a real
aligned unit before committing them. A wrong key (a keydb VK that doesn't
match the disc, a stale UK) is rejected with AacsKeyRejected instead of
silently applying garbage unit keys. Conservative by design: with no samples
(resume / mapfile cache) it accepts as before, leaving those paths unchanged.

The KeySource trait becomes a stateful provider — next_key hands one candidate
at a time (the source owns the order) and reports exhaustion, replacing the
all-at-once resolve; errored() distinguishes a failed source from a clean
no-key.

src/mux/resolve.rs

@@ -218,7 +218,9 @@ pub fn input(url: &str, opts: &InputOptions) -> io::Result<Box<dyn crate::pes::S
             // yields them for the stream below. Propagate a failed application
             // rather than silently muxing an undecryptable stream.
             if !opts.unit_keys.is_empty() {
-                disc.decrypt_with(crate::disc::Key::Unit(opts.unit_keys.clone()))
+                // These UKs were already resolved AND validated by the caller
+                // (the CLI's keydb loop), so no re-validation sample is needed.
+                disc.decrypt_with(crate::disc::Key::Unit(opts.unit_keys.clone()), &[])
                     .map_err(|e| -> io::Error { e.into() })?;
             }
             // No-key guard: if decryption is requested (not --raw) and the disc