Vendor vcpkg as a cross-platform submodule

[svnscha]

Summary

• vendor vcpkg as a tracked repository submodule pinned to the existing baseline commit
• make the build, devcontainer, and GitHub workflows use the vendored ./vcpkg path by default
• update contributor docs and task tracking for the new clone, bootstrap, and maintenance flow

Changes

• add .gitmodules and track vcpkg as a submodule instead of ignoring it
• simplify CMakeLists.txt to require the vendored toolchain and drop fallback discovery paths
• update .devcontainer/setup-vcpkg.sh and devcontainer setup to initialize and bootstrap the submodule
• switch CI and dependabot validation workflows to checkout submodules rather than separately cloning microsoft/vcpkg
• rewrite README.md and docs/usage.md for submodule-first setup on Windows, macOS, and Linux
• record the implementation and validation state in .tasks/vcpkg-submodule-cross-platform.md

Validation

• bootstrapped the vendored submodule with .devcontainer/setup-vcpkg.sh
• ran cmake -S . -B build -G Ninja
• ran cmake --build build --config Release --target yaaf libyaaf_tests
• ran ctest --test-dir build --output-on-failure -L default
• verified a fresh clone flow with git clone --recurse-submodules, bootstrap, configure, and build

Notes

• the local task file still tracks the Linux musl / hosted CI execution item for CI to confirm in the PR