Teach the fake test agent SNMPv3/USM so v3 is testable without snmpd

[tobez]

The test suite's scriptable fake SNMP agent previously spoke only v1/v2c, so
exercising the daemon's SNMPv3 stack required a real net-snmp agent
(t/real-snmpd.t, opt-in and environment-dependent). This PR makes v3 behavior
and misbehavior testable deterministically with make test alone.

• t/lib/SQE/USM.pm — independent pure-Perl USM crypto (RFC 3414 key
  localization for sha1/sha224/sha256/sha384/sha512, truncated HMAC,
  AES-128-CFB per RFC 3826), unit-tested against RFC 3414 known-answer
  vectors in t/usm.t. Being independent of the C implementation, it
  cross-validates the daemon's v3_keys.c / v3_crypto.c end-to-end.
• t/lib/SQE/FakeAgent.pm — the v1/v2c PDU-processing core is extracted
  into a shared _process_pdu (behavior-neutral refactor), and a v3
  envelope layer is added on top: engine boots/time discovery via a
  not-in-time-windows REPORT, request-side HMAC verification, AES-CFB
  decryption, and encrypted+authenticated replies (authPriv only, matching
  what the daemon emits). Misbehavior knobs: v3_never_sync (agent stays
  silent), v3_report (forced usmStats report type), and v3_reply_fault
  (reply signed with a corrupted key, wrong engine id, or wrong username).
• t/behavior-v3.t — end-to-end integration tests driving the real
  daemon: discovery → time-sync → authPriv GET happy path, plus one
  scenario per misbehavior knob asserting the daemon drops the bad reply
  and bad_snmp_responses climbs.
• CI — Crypt::Rijndael (the one new test-only CPAN dependency) added
  to all cpanm install steps; README's test-dependency list updated.

AES-256 privacy is out of scope: the daemon's setopt path rejects it, so it
is unreachable from tests.

Test plan

• make test — 19 files, 393 tests, all green, no snmpd/docker/root
• t/usm.t validates key localization against RFC 3414 A.3.1 vectors
• t/behavior-v3.t exercises the daemon's real crypto end-to-end
• Existing t/behavior.t / t/protocol.t counts unchanged after the
  PDU-core refactor
• t/real-snmpd.t untouched (still available for cross-checking against
  a real net-snmp agent)