fix(crypto): harden keybag, ASN.1 and key derivation code paths

[BuenGenio]

Summary

Audit and hardening of the existing software-encryption code path (keybag parsing, ASN.1/DER decoding, PBKDF2, volume key handling). All changes are on the read path — behaviour is unchanged for a well-formed encrypted volume; the goal is to make corrupt or hostile input fail safely instead of reading out of bounds or crashing.

##Bugs fixed

• OOB reads on a corrupt keybag — Keybag::Init trusted kl_nbytes from disk as the assign() size; Keybag::GetKey/FindKey walked the variable-length entry list with no bounds checks. Both can read past m_data. Now validated/bounds-checked.
• Wrong block verification — LoadKeybag verified the whole buffer blockcnt times with identical arguments instead of verifying each block. Now verifies each block individually.
• LoadKeybag robustness — ignored ReadBlocks return value; unbounded resize() from a corrupt block count; m_is_unencrypted could be set by a volume (recs) keybag. All fixed.
• ASN.1 parser UB — der_decode_len/der_decode_tl formed out-of-bounds pointers and could dereference nullptr. Replaced pointer arithmetic with size comparisons.
• PBKDF2 iteration truncation — iterations was int, but the keybag value is uint64_t, so a large count truncated to a negative int and silently derived the wrong key. Changed to uint32_t.
• GetVolumeKey null-deref — the password parameter defaults to nullptr but the body called strlen() on it. Now treated as empty.

Hardening / cleanup

• Zero derived key material (dk, kek, vek) from the stack after use.
• Extract duplicated volume-encryption setup into ApfsVolume::InitVolumeKey(), fixing a divergent guard between Init and MountSnapshot.
• Remove dead variables.

Build fix (second commit)

fix(build): add missing include to PList.h — pre-existing and unrelated to crypto, but required for the project to build at all on GCC 15 / libstdc++ 15, which no longer leaks transitively.

Testing

Built with cmake + make (GCC 15, Release):

crypto library — built (covers Asn1Der.cpp, Crypto.cpp)
libapfs.a — built (covers KeyMgmt.cpp, ApfsVolume.cpp)
apfsutil, apfs-dump, apfs-dump-quick — compiled and linked
All modified files compile with no new warnings under -Wall -Wextra