chore: prepare v0.52.0 release

[tobbee]

[0.52.0] - 2026-05-12

Added

• KID-aware decryption key selection in mp4ff-decrypt via repeated --key kid:key flags (PR feat: enhance key handling to support kid:key pairs and improve decryption logic #490)
• DecryptSegmentWithKeys and DecryptFragmentWithKeys functions in mp4 package for
  multi-key decryption using KID/key maps. Currently only reads KID from tenc box
  (seig sample group entry overrides are not yet supported)
• Fragment.ParseSenc() and MediaSegment.ParseSenc() methods to parse senc boxes
  using encryption info from a separate init segment
• SencBox.IsParsedByGuess() to check if senc was parsed by heuristic
• Support for IAMF (Immersive Audio Model and Formats) iamf sample entry and
  iacb configuration box, including parsing of IAMF OBU headers for info dumping
• Support for the legacy PIFF protection scheme (schm.scheme_type = 'piff')
  with PIFF TrackEncryption UUID box 8974dbce-7be7-4c51-84f9-7148f9882554.
  AlgorithmID 1/2 are mapped to cenc/cbcs respectively (issue Support scheme_type piff #496)

Fixed

• senc parsing when init segment is in a separate file (issue Panic when decrypt segment #492).
  The perSampleIVSize is now determined with correct priority:
  1. seig sample group entry, 2. tenc from init segment, 3. heuristic with saiz validation
• DecodeSenc now delegates to DecodeSencSR removing duplicated code
• Heuristic senc parsing validates candidates against saiz sample sizes,
  preventing incorrect perSampleIVSize selection
• mp4.NewPsshBox now stores the supplied data argument on the returned
  box instead of dropping it (issue mp4.NewPsshBox constructor throws away box data #497)
• IV is now advanced between fragments when encrypting multiple cenc fragments
  with mp4ff-encrypt, avoiding IV/keystream reuse across fragments (issue mp4ff-encrypt for cenc does not increment IV between fragments #499)

Changed

• Minimum Go version bumped from 1.16 to 1.17 (ARM64 macOS support)
• mp4.EncryptFragment now returns (nextIV []byte, err error) so callers
  can chain the IV across fragments. Update call sites that previously
  captured only the error