codec: update vendored VaptVupt codec 2.65.0 -> 2.65.3

From vaptvupt-codec tag v2.65.3. Output is byte-identical to 2.65.0 (same
ratio, wire format v1.6 unchanged) but extreme-mode encode is ~1.6-2x faster
(Sprint 132 optimal-parser speedup) and the extreme prepass window allocation
is capped at wlog=20 = 8 MiB virtual instead of up to 128 MiB (Sprint 133
memory hygiene). Our AVX2 offset-read decoder guard is now UPSTREAM (dropped
from the local patch set); the ANS safe-zone 2*SAFEZONE_MAX_RUN reserve is
re-applied on top (still not upstream). make check 16/16, KAT 16/16, cross-
version roundtrip with 5.1.0 archives verified.

vendor/vuptsdk/include/zsdk_hkdf.h

@@ -0,0 +1,41 @@
+/*
+ * HKDF-SHA3-256 (RFC 5869, with SHA3-256 as the hash)
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ *
+ * SHA3-256 is preferred over SHA-256 here because Keccak's sponge
+ * construction has stronger structural properties (no length-extension,
+ * indifferentiable from a random oracle in the standard model).
+ */
+#ifndef ZSDK_HKDF_H
+#define ZSDK_HKDF_H
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <stddef.h>
+#include <stdint.h>
+
+#define ZSDK_HKDF_HASHLEN 32  /* SHA3-256 output size */
+
+/* HKDF-Extract: PRK = HMAC-SHA3-256(salt, IKM) */
+void zsdk_hkdf_extract(uint8_t        prk[32],
+                       const uint8_t *salt, size_t salt_len,
+                       const uint8_t *ikm,  size_t ikm_len);
+
+/* HKDF-Expand: produces `out_len` bytes (out_len <= 255 * 32). */
+int zsdk_hkdf_expand(uint8_t       *out, size_t out_len,
+                     const uint8_t  prk[32],
+                     const uint8_t *info, size_t info_len);
+
+/* Convenience: extract+expand in one call. */
+int zsdk_hkdf(uint8_t       *out,  size_t out_len,
+              const uint8_t *salt, size_t salt_len,
+              const uint8_t *ikm,  size_t ikm_len,
+              const uint8_t *info, size_t info_len);
+
+
+#ifdef __cplusplus
+}
+#endif
+#endif