feat: enhance key handling to support kid:key pairs and improve decryption logic

[g3gg0]

This change adds support for KID-aware decryption key selection in mp4ff-decrypt, aligned with other tools that accept:
--key <kid>:<key>

When KID/key pairs are provided, the decrypt flow reads the track KID from encrypted headers and automatically selects the matching key.

Behavior

• Supports repeated --key <kid>:<key> entries.
• KID is normalized and matched as 32-char hex without dashes.
• Duplicate KID entries fail hard.
• If KID/key pairs are provided and no key matches a required track KID, decryption stops with an error.
• Legacy single-key mode is still supported.
• Legacy key format and KID/key format cannot be intermixed in one invocation.

AI-generated code notice

• Big parts of this change were produced with AI assistance and then manually reviewed, edited, and validated with project tests before submission.
• Altough human interaction was involved, I am not certain that it doesn't interfere with anything else out there
• So please still review thoroughly, it still might come handy :)

best regards,
g3gg0