v0.4.0: audio and video, cleaned without holding the file

Closes #15. Ports upstream's av_meta.py at 4a0fbc3.

Audio and video in the browser

MP4/MOV/M4A/M4V, WAV, MP3 and FLAC (js/av_meta.js). Top-level jumb/c2pa/uuid (XMP) ISOBMFF boxes and moov/udta generator tags; WAV C2PA, LIST INFO and id3 chunks; ID3v2 frames in MP3; C2PA's GEOB application/c2pa frame in FLAC. Samples and frames are never touched. MP4 reuses the ISOBMFF box walker that already backs AVIF and HEIC.

Cleaning a video does not mean holding it

The engine ships two drivers over the same primitives. The buffer driver is the faithful one the parity suite holds to upstream byte for byte. The slice driver walks box and chunk headers through File.slice() and returns a Blob of slices of the original file, because metadata is a few hundred bytes at known offsets and an ISOBMFF drop is an equal-size free box: a clean is the original with a few ranges overwritten.

  4 MB | identical true | 6 reads, 0.32 KB read (0.0078% of the file)
 32 MB | identical true | 6 reads, 0.32 KB read (0.0010% of the file)
128 MB | identical true | 6 reads, 0.32 KB read (0.0002% of the file)

The 64 MiB browser limit no longer applies to audio and video. The Inspector tab, which still reads its input whole, now enforces that limit instead of reading anyway.

Only MP4 inspection has to touch every byte, and it does so in 4 MiB chunks at 432 MB/s, awaiting between them so the tab stays responsive.

A truncated MP4 keeps its media

Upstream's _strip_moov_udta rebuilds an MP4 from the boxes that parsed and drops the rest, while the action list says the tail was kept: 3267 bytes in, 187 out. That is the failure mode #170 and #182 fixed for PNG and ISOBMFF. This port keeps the tail. Reported as guillaumemeyer/watermarks-remover#240, recorded in scripts/upstream-sources.json, and asserted side by side with upstream's behaviour in the parity suite.

Anchors

New: av_meta.py 992981922d27. The other four are unchanged.

Test suite: 843 passed, up from 584.