SubGhz: add Cardin S508 rolling-code decoder (decode-only)

[half2me]

What

Adds a decode-only Sub-GHz protocol for the Cardin S508 868 MHz rolling-code remote (S500-series, FCC ID TXQ508; the 2-channel S504 uses the same protocol). It recognizes the remote in Read mode and displays the on-air codeword. It's the 868 MHz sibling of the 433.92 MHz Cardin S449 (KeeLoq) from #908 — a different protocol on a different band.

Protocol (reverse-engineered)

• 868.35 MHz, 2-FSK (~12 kHz dev), read with the FM12K preset.
• Manchester / biphase, half-bit ≈ 100 µs. On a real capture the 2-FSK slicer is duty-cycle biased (high half-bits read longer than low), so classification uses per-level timing bands.
• Codeword = 140 bits: a 12-bit fixed sync 110011110100 + a 128-bit fully-rolling payload. Every payload bit changes between presses; there is no cleartext serial, button, or counter — those live inside the encrypted block. Cardin documents this family as "128-bit cryptography", consistent with a 128-bit AES ciphertext, which is stored and shown as an opaque hex blob.

Decode/display only — by design

The rolling payload is encrypted and the key resides in the receiver, so valid future codes cannot be generated. Emulation is impossible and is intentionally not implemented: no encoder, no "Add Manually", no TX path (the encoder vtable is an all-NULL stub). This is purely an RX/identification contribution — it cannot open a gate.

Implementation notes

• Modeled on the repo's existing Manchester FSK decoders; reuses the shared manchester_advance helper. Decode-only structure follows ido.
• The helper decodes this remote's convention complemented, so the decoder locks on either the sync or its complement and normalizes to the canonical form (codeword always begins 110011110100).
• 128-bit payload stored across data/data_2, serialized with the kinggates_stylo_4k extra-field pattern.

Testing

• Hardware-verified: flashed to a Flipper; both an on-device subghz decode_raw replay and a live read of a real remote detect the protocol and show a 140-bit codeword with the constant sync and a per-press-changing 128-bit Key.
• Regression test added (RAW .sub replay) under applications/debug/unit_tests/.
• Coverage caveat: validated against one physical remote; no public bit-level spec exists, so the model is derived from clean captures.

[mishamyte]

So without encoder we can't accept it. So putting in the backlog