Fix ES descriptor and AudioSpecificConfig parsing

[kixelated]

Summary

• encode descriptor sizes in ISO/IEC 14496-1 base-128 order and reject overlong size fields
• preserve optional ES descriptor flag payloads instead of parsing them as child descriptors
• decode and encode extended AAC object types, channel configurations, and explicit sample rates correctly
• add focused regression coverage for each reported edge case

Root cause

Descriptor lengths were emitted least-significant group first, while decoding expected most-significant group first. AudioSpecificConfig fields that cross byte boundaries were extracted with byte-local masks and shifts, and optional ES descriptor fields were ignored without advancing over their payloads.

Impact

Descriptors with bodies of at least 128 bytes, zero-length unknown descriptors, extended AAC profiles, explicit sample rates, or optional ES descriptor flags now encode and decode without corrupting or desynchronizing the stream.

Validation

• cargo test --all-targets — 242 passed
• just check — all-feature check, strict Clippy, formatting, and dependency analysis passed
• git diff --check

Closes #192