Run the real libmp4.prx/mp4msv.prx instead of our sceMp4 HLE, when asked

The MP4 libraries turn out to be the easiest place to hand a game Sony's own
code: libmp4.prx needs only sceAudiocodecInit and sceAudiocodecDecode from us
plus ordinary kernel calls, and mp4msv.prx - where the 41 functions libmp4
leans on live - imports nothing at all. So with a firmware dump present the
pair can be loaded for real and left to decode through our sceAudiocodec.

Adds DisableHLEFlags::sceMp4, which loads and starts both modules when the
game asks sceUtility for the MP4 module, and a --disable-hle bitmask so a
headless run can ask for this without a config file.

Two things had to be fixed to make it work at all:
 - ModuleMgrForUser 0xD2FBC957 was unimplemented, and libmp4 calls it to get
   the gp of each callback it is handed. Implemented as
   sceKernelGetModuleGPByAddress.
 - Headless forced every module to HLE unconditionally, which silently undid
   the flag, and it did so before ApplyToConfig() had even parsed it.

Tested with Speedball 2 - Evolution, which uses sceMp4 for its music: the game
goes from 255645 calls into our stubs and 39 unresolved imports, to zero of
each and 1943 AAC frames decoded through sceAudiocodec.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Core/CmdLine.cpp

@@ -217,6 +217,7 @@ static const CommandLineParam g_autoParams[] = {
 	{POFF(debuggerPort), CmdParamType::Int, "debugger", '\0', "Enable the WebSocket debugger on this port (0 = pick automatically); see docs/WebSocketDebugger.md"},
 	{POFF(autoSaveLoadSymbols), CmdParamType::Bool, "auto-save-load-symbols", '\0', "Auto save/load per-module and per-game symbol files (see bAutoSaveLoadSymbols)", CmdLineMode::Both},
 	{POFF(bootVSH), CmdParamType::Bool, "vsh", '\0', "Boot the VSH (requires files dumped from a PSP in the flash0 directory)"},
+	{POFF(disableHLE), CmdParamType::Int, "disable-hle", '\0', "Bitmask of libraries to run the real firmware module for instead of our HLE", CmdLineMode::Both},
 	{POFF(memReadAction), CmdParamType::Enum, "memread", '\0', "Set the action for memory read exceptions", CmdLineMode::Both, g_ExceptionActionValues, ARRAY_SIZE(g_ExceptionActionValues)},
 	{POFF(memWriteAction), CmdParamType::Enum, "memwrite", '\0', "Set the action for memory write exceptions", CmdLineMode::Both, g_ExceptionActionValues, ARRAY_SIZE(g_ExceptionActionValues)},
 	{POFF(breakAction), CmdParamType::Enum, "break", '\0', "Set the action for break exceptions", CmdLineMode::Both, g_ExceptionActionValues, ARRAY_SIZE(g_ExceptionActionValues)},
@@ -544,6 +545,12 @@ void CommandLineOptions::ApplyToConfig() const {
 		g_Config.DoNotSaveSetting(&g_Config.bAutoSaveLoadSymbols);
 	}
 
+	if (disableHLE.has_value()) {
+		// DoNotSaveSetting so a per-game config can't quietly put the HLE back.
+		g_Config.iDisableHLE = disableHLE.value();
+		g_Config.DoNotSaveSetting(&g_Config.iDisableHLE);
+	}
+
 	if (logLevel.has_value()) {
 		g_logManager.SetAllLogLevels(logLevel.value());
 	}