Implement secure AES-CBC encryption with external C++ decryption

- Replace weak ECB encryption with AES-128-CBC + PKCS7 padding
- Implement secure key derivation: SHA256(password + salt)
- Add cryptographically secure random IV generation
- Create standalone C++ decryptor for external binary decryption
- Update stub to require external decryption workflow
- Maintain cross-platform compatibility (Linux/Windows)
- Add proper error handling and padding validation

Security improvements:
- AES-128-CBC instead of ECB (prevents pattern analysis)
- Random IVs prevent identical plaintext producing identical ciphertext
- Password-based key derivation with salt
- PKCS7 padding with validation
- External decryption prevents embedded keys

stub/Cargo.lock

@@ -1,6 +1,6 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4
 
 [[package]]
 name = "aes"
@@ -91,6 +91,7 @@ version = "0.1.0"
 dependencies = [
  "aes",
  "inside-vm",
+ "libc",
  "memexec",
  "winreg",
 ]