feat(youtube): SABR extractor support (PoC)

[Priveetee]

PoC for the extractor side of SABR. Implements #67.

Docs (how SABR works end to end: protocol, UMP, attestation): https://priveetee.github.io/Docs-PipePipe/developer-guide/introduction

Related:

• SABR client playback integration (PoC) PipePipeClient#42 (client side)
• [YouTube] Content Not Yet Suppoted (SABR) after 5.1.0 PipePipe#2330 ([YouTube] Content Not Yet Supported (SABR) after 5.1.0)
• [YouTube] Coordinating efforts on SABR implementation TeamNewPipe/NewPipe#12248 ([YouTube] Coordinating efforts on SABR implementation)

Summary

Adds the full SABR stack on the extractor side, behind a new DeliveryMethod.SABR so it only activates on SABR-only videos and leaves the existing DASH/HLS/progressive paths untouched.

Changes

• UMP wire reader + minimal protobuf codec.
• VideoPlaybackAbrRequest builder + client profile.
• SABR session and state (request number, playback cookie, buffered ranges, player time).
• UMP response decoder (media headers, init metadata, next-request policy, stream protection status, onesie/context parts).
• Media segment + index parsers.
• Format selection by what the device can actually decode in hardware.
• Bounded segment cache so a high-bitrate (4K) stream can't OOM.
• Session survives a transient backoff interrupt instead of killing itself.
• SABR-DIAG per-round diagnostics behind a flag (off-able, easy to strip).
• Wires SABR into YoutubeStreamExtractor behind the new delivery method.

Why

YouTube keeps moving playback to SABR, where the old URL/manifest model doesn't apply. This makes the extractor able to build the request, decode the UMP response and drive a SABR session so the client can play those videos. See #67 and the doc above.

Validation

• ./gradlew :extractor:compileJava -x checkstyleMain
• Runs end to end with the client PoC on a real device (Pixel 8 / GrapheneOS / Vanadium WebView): PO token accepted, protection flips back to playable, init + media segments download and decode (hardware VP9/H264).
• No OOM on long 4K playback (bounded cache).
• Protected (status=3) videos reach real media once a valid content-bound token is in the request.

Notes

• It's a PoC and a chunky one. Sustained playback is currently gated by a client-side player issue (SABR client playback integration (PoC) PipePipeClient#42), not by the extractor or the protocol.
• Extractor side is player-agnostic, so no media3 dependency either way.
• Happy to split this into smaller PRs if you'd rather review it in chunks, just tell me what you prefer.
• checkstyleMain excluded for the same repo-wide reasons as previous PRs.