[kvinwang]

luks2 0.5.0 is unmaintained and is the only path to mio 0.7.14 (Dependabot alert, dismissed as Windows-only in #1494). dstack-util only uses it to decode headers in validate_luks2_headers, so this replaces it with a small system_setup/luks.rs that models just the fields that function checks. The validation logic is unchanged.

• Checks luks2 did implicitly at parse time are kept; keyslots_size % 4096 is now explicit.
• Unknown KDF types still decode and are rejected with Invalid LUKS keyslot KDF, so existing tests keep their error messages.
• A differential run of 30 header mutations (type tags, priority, flags, integrity, tokens, digest refs, unaligned sizes, numeric-vs-string offsets, trailing garbage, ...) gives identical accept/reject results to the old code.
• Relaxed: KDF/digest salt, iterations, digest and config.json_size no longer have to be present. The validator never inspected them and cryptsetup rejects headers without them.

Drops crossterm, mio 0.7, and the old aes/hmac/pbkdf2/sha2 0.9 crates from Cargo.lock.