codec: update vendored VaptVupt codec 2.65.0 -> 2.65.3

From vaptvupt-codec tag v2.65.3. Output is byte-identical to 2.65.0 (same
ratio, wire format v1.6 unchanged) but extreme-mode encode is ~1.6-2x faster
(Sprint 132 optimal-parser speedup) and the extreme prepass window allocation
is capped at wlog=20 = 8 MiB virtual instead of up to 128 MiB (Sprint 133
memory hygiene). Our AVX2 offset-read decoder guard is now UPSTREAM (dropped
from the local patch set); the ANS safe-zone 2*SAFEZONE_MAX_RUN reserve is
re-applied on top (still not upstream). make check 16/16, KAT 16/16, cross-
version roundtrip with 5.1.0 archives verified.

vendor/vuptsdk/include/zsdk_aes256_gcm_siv.h

@@ -0,0 +1,39 @@
+/*
+ * AES-256-GCM-SIV (RFC 8452)
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ *
+ * Nonce-misuse-resistant AEAD. Nonce reuse degrades to deterministic
+ * encryption (same plaintext+key+nonce -> same ciphertext) rather than
+ * the catastrophic XOR-of-plaintexts of GCM/CTR.
+ */
+#ifndef ZSDK_AES256_GCM_SIV_H
+#define ZSDK_AES256_GCM_SIV_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <stddef.h>
+#include <stdint.h>
+
+#define ZSDK_AES256_GCM_SIV_KEYBYTES   32
+#define ZSDK_AES256_GCM_SIV_NONCEBYTES 12
+#define ZSDK_AES256_GCM_SIV_TAGBYTES   16
+
+void zsdk_aes256_gcm_siv_encrypt(uint8_t *out,
+                                 const uint8_t *plaintext, size_t pt_len,
+                                 const uint8_t *aad, size_t aad_len,
+                                 const uint8_t key[32],
+                                 const uint8_t nonce[12]);
+
+int zsdk_aes256_gcm_siv_decrypt(uint8_t *out,
+                                const uint8_t *ciphertext, size_t ct_len,
+                                const uint8_t *aad, size_t aad_len,
+                                const uint8_t key[32],
+                                const uint8_t nonce[12]);
+
+
+#ifdef __cplusplus
+}
+#endif
+#endif