fix(build): drop compile-time x86 target-features — runtime AES dispatch

Users on CPUs without AES-NI (Nehalem i7-860, pre-2010 Intel Macs) or
without SSSE3 (AMD Phenom II) crashed at launch with SIGILL. The
global `-C target-feature=+aes,+ssse3` was kept after the #353/#343
x86-64-v3 incident on the belief that the aes crate's cpufeatures
runtime check would protect CPUs without AES-NI — but a compile-time
target feature makes cpufeatures compile its check to a constant, so
the AES-NI intrinsics ran unconditionally (credentials AES-GCM decrypt
at startup), and +ssse3 let LLVM autovectorize anywhere, breaking
Phenom II. Measured on the qbz-cmaf hot path (Ctr128BE<Aes128>
apply_keystream, 256 MB, release): 2145 MB/s compiled-in vs 2162 MB/s
runtime-dispatched, identical output — the flags bought nothing on
capable CPUs. Removed from .cargo/config.toml, all dev/build scripts
and the release/build workflows; old CPUs now get the software AES
fallback instead of a crash.

Fixes #549

cc

.github/workflows/release-snap.yml

@@ -91,7 +91,7 @@ jobs:
           CARGO_BUILD_JOBS: '1'
           CARGO_PROFILE_RELEASE_CODEGEN_UNITS: '256'
           CARGO_PROFILE_RELEASE_OPT_LEVEL: '2'
-          RUSTFLAGS: '-C target-feature=+aes,+ssse3 -C link-arg=-fuse-ld=mold -Z threads=1'
+          RUSTFLAGS: '-C link-arg=-fuse-ld=mold -Z threads=1'
         run: |
           cargo build --release --manifest-path crates/Cargo.toml -p qbz
           strip crates/target/release/qbz || true