Add transport channel-binding substrate

[davidtorcivia]

Summary

• add a fixed-width, redacted ChannelBinding type to the transport contract
• derive the binding from the quiche TLS exporter after handshake completion and clear it on disconnect
• require explicit deterministic binding injection in the simulator
• pin the quiche fork exporter commit and update the public API snapshot

Dependency provenance

• pinned-revision exporter commit: 6138b4d754263edf7f0164f12e46e8277dd5d674
• current fork integration: Expose TLS exporter keying material quiche#2
• upstream submission: Expose TLS exporter keying material cloudflare/quiche#2578

Validation

• cargo fmt --all --check
• cargo +1.88.0 clippy --workspace --all-targets --locked -- -D warnings
• CARGO_TARGET_DIR=/tmp/vot-target cargo +1.88.0 test --workspace --locked
• CARGO_TARGET_DIR=/tmp/vot-target cargo +1.88.0 test -p vot-transport-quiche --features live --release --locked
• python3 tools/check_public_api.py
• diff-scoped cargo-mutants for vot-transport-api, vot-transport-sim, and live vot-transport-quiche
• python3 tools/check_live_mutants.py --evidence=test-vectors/mutants/the_quiche_pump_is_mutation_tested.md /tmp/quiche-mutants.log