Sign the escrow request as the Mac whose anisette the session uses

[gregakespret]

The keychain escrow request now presents the session's own Mac identity
when anisette comes from a real Mac. Before, it presented the configured
device's identity, which under export-findmy's FakeIOSConfig is an
iPhone. Apple answered -3001, so the trust circle was never joined and
no accessory keys came back.

escrow_anisette_headers picks the X-Mme-Client-Info the escrow call
sends. For a macOS identity it keeps the Mac's model and OS and swaps in
only the escrow service's application component (sbd). An Android
identity is passed through unchanged. Anything else, including the
iPhone identity a v3 anisette server reports for FakeIOSConfig, gets
the configured service identity, which is exactly what it got before. A
failed escrow request now also logs its command, HTTP status, host,
identity profile and Apple's error code.

gregakespret/export-findmy production has run this branch since
gregakespret/export-findmy#20. That is why this PR should land: the pin
sits on a branch that was never merged here. Any export-findmy change
that re-pins to findmy-export-support drops the escrow fix and breaks
connects again. The open export-findmy PRs that bump rustpush do exactly
that. In the other direction, production lacks #11. Once this is merged,
export-findmy can pin findmy-export-support again.

The two sides touch different files (src/icloud/keychain.rs here, the
apple-private-apis submodule pin on findmy-export-support), so the
merge is clean. cargo test --lib passes all 13 tests at 7363665, including
the three new escrow_identity_tests.

Review notes, not changed here: the new
headers["X-Mme-Client-Info"].to_str().unwrap() in
send_escrow_request panics if the identity holds a byte outside
visible ASCII, the same risk as the existing b.parse().unwrap() a few
lines up. The Mac/Android detection is written twice, once in the helper
and once for the log profile. Nothing in export-findmy reaches the
Android branch, since no provider it uses reports an Android identity.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UQoQ8qnF9rH1axBYS6Nqrn