Provide RFC 3394 default IV explicitly for AES key wrap

[gregakespret]

The two Crypter::new(...ID_AES128_WRAP..., None) / decrypt(..., None, ...)
calls in rfc6637_wrap_key / rfc6637_unwrap_key panic at runtime against
recent openssl crate releases (0.10.80+) with:

thread 'main' panicked at openssl/symm.rs:623:
an IV is required for this cipher

openssl's Crypter::new now enforces that any cipher whose iv_len()
is non-zero must be supplied an IV explicitly; passing None no longer
falls through to the cipher's default.

The two call sites here are RFC 6637 OpenPGP key-wrap helpers and both
internally use AES Key Wrap (RFC 3394). RFC 3394 §2.2.3.1
defines the default initial value for the wrap function as the constant
0xA6A6A6A6A6A6A6A6, used when no Alternative Initial Value is supplied.

This PR passes that constant explicitly. The wire-level output is
identical to what older openssl versions produced when None was passed
— the constant is exactly what the cipher was already using internally as
its IV default; we're just no longer relying on openssl to fill it in.

How was this tested

Built locally against openssl = 0.10.80 and ran export-findmy against
my live iCloud account: previously panicked at the first
pcs_keys_for_record call (the FindMy BeaconStore zone returns
PCS-encrypted records that need RFC 6637 unwrap during key derivation);
after the fix, all 9 MasterBeaconRecords decrypt cleanly and downstream
findmy.py location fetch returns reports for all 4 AirTags on the
account.

Reproducible: any CloudKit zone returning PCS-encrypted records will hit
this path. The FindMy BeaconStore zone is the easiest reproduction (via
thisiscam/export-findmy).

[gregakespret]

Closing as a duplicate of OpenBubbles/rustpush#22 — same one-line fix (RFC 3394 default IV constant for AES_128_WRAP), opened upstream by @malmeloo 2026-05-05 and still awaiting review.

Leaving a reproduction signal on the upstream PR so it can be picked up there. If/when upstream merges and this fork rebases, the fix will land here automatically. Apologies for the noise — should have grep'd upstream PRs before filing.