fix(drm): include external KID in PSSH when it differs from existing KIDs

When the DASH manifest provides a cenc:default_KID that differs from the PSSH's embedded KIDs, the external KID must be added to the PSSH so the license server returns keys for both. Previously, the PSSH was only modified when all existing KIDs were placeholders, causing a CEKNotFound error when the track's actual encryption KID wasn't in the license response.

unshackle/core/drm/widevine.py

@@ -53,6 +53,8 @@ class Widevine:
             self._kid = kid
             if pssh.key_ids and all(k in self.PLACEHOLDER_KIDS for k in pssh.key_ids):
                 pssh.set_key_ids([kid])
+            elif kid not in (pssh.key_ids or []):
+                pssh.set_key_ids([*(pssh.key_ids or []), kid])
 
         self._pssh = pssh