Run the real libmp4.prx/mp4msv.prx instead of our sceMp4 HLE, when asked

The MP4 libraries turn out to be the easiest place to hand a game Sony's own
code: libmp4.prx needs only sceAudiocodecInit and sceAudiocodecDecode from us
plus ordinary kernel calls, and mp4msv.prx - where the 41 functions libmp4
leans on live - imports nothing at all. So with a firmware dump present the
pair can be loaded for real and left to decode through our sceAudiocodec.

Adds DisableHLEFlags::sceMp4, which loads and starts both modules when the
game asks sceUtility for the MP4 module, and a --disable-hle bitmask so a
headless run can ask for this without a config file.

Two things had to be fixed to make it work at all:
 - ModuleMgrForUser 0xD2FBC957 was unimplemented, and libmp4 calls it to get
   the gp of each callback it is handed. Implemented as
   sceKernelGetModuleGPByAddress.
 - Headless forced every module to HLE unconditionally, which silently undid
   the flag, and it did so before ApplyToConfig() had even parsed it.

Tested with Speedball 2 - Evolution, which uses sceMp4 for its music: the game
goes from 255645 calls into our stubs and 39 unresolved imports, to zero of
each and 1943 AAC frames decoded through sceAudiocodec.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

headless/Headless.cpp

@@ -727,13 +727,18 @@ int main(int argc, const char* argv[]) {
 	g_Config.iReverbVolume = VOLUMEHI_FULL;
 	g_Config.internalDataDirectory.clear();
 	g_Config.bUseOldAtrac = oldAtrac;
-	g_Config.iForceEnableHLE = 0xFFFFFFFF;  // Run all modules as HLE. We don't have anything to load in this context.
 	g_Config.bSkipDeadbeefFilling = false;
 
 	// ApplyToConfig() has the final say, applied after RestoreDefaults() and the headless
 	// overrides above, so a matching command line flag always wins.
 	cmdLineOptions.ApplyToConfig();
 
+	// Run all modules as HLE - a headless run normally has no firmware to load them from. An
+	// explicit --disable-hle means the caller does have a dump and wants the real thing, so leave
+	// the modules they asked for alone.
+	g_Config.iForceEnableHLE = 0xFFFFFFFF & ~g_Config.iDisableHLE;
+
+
 	// This looks contradictory to the above. But, this preserves the old test behavior which apparently ran the JIT for the CPU
 	// but ended up running software vertex decoding due to the setting in g_Config. Yeah, it's a mess.
 	CPUCore cpuCore = CPUCore::JIT;