Allow cryptex to be mandatory-to-use

[fippo]

follow-up to #777

https://mailarchive.ietf.org/arch/msg/avt/pGnete_6IqExxTERNl44_9GqVRU/
made a good point: one might interpret (which the W3C spec currently does not) cryptex as mandatory to use.
In this mode srtp_unprotect would fail with an error.

The error returned might be srtp_err_status_cryptex_err which would use it in a different context than currently but that might be ok.

This would require

• adding int require_cryptex to the private srtp_stream_ctx_t_,
• adding srtp_set_stream_require_cryptex similar to srtp_set_stream_use_cryptex
• having srtp_cryptex_unprotect_init return the error if require_cryptex is true but inuse is false and there are header extensions.
• adding a test that srtp_unprotect fails with plaintext extensions

I think that plan works for both 2.8+ and 3.x

Happy to take a stab if that sounds like a plan, main question I have is whether it is ok to reuse the error.

[fippo]

note: if there is a 2.8.1 it should also cherry-pick the fmt specifier fix that e.g. Mozilla had to make:
https://searchfox.org/firefox-main/source/third_party/libsrtp/00_use_consistent_printf_types.patch
(will have to do the same for Chrome)