[BUG] Memory leak in free_sub_track(): blockaddition and message buffer never freed for WebVTT tracks

## Description
In `src/lib_ccx/matroska.c`, the function `free_sub_track()`
iterates over all sentences and frees `sentence->text` and
the sentence itself, but never frees `sentence->blockaddition`
or the backing `message` buffer that was allocated in
`parse_segment_cluster_block_group_block_additions()`.

## Affected Code
`src/lib_ccx/matroska.c` — function `free_sub_track()`

## Root Cause
In `parse_segment_cluster_block_group_block_additions()`,
a `message` buffer is allocated via `read_bytes_signed()`
and a `block_addition` struct is allocated via `calloc()`.
The fields `cue_settings_list`, `cue_identifier`, and
`comment` are pointers into that `message` buffer.

In `free_sub_track()`, neither the `block_addition` struct
nor the `message` buffer are ever freed, causing a memory
leak on every WebVTT subtitle that contains BlockAdditions.

## Steps to Reproduce
Process any `.mkv` file containing WebVTT subtitle tracks
with BlockAdditions (cue settings, identifiers, or comments).
Run with a memory checker such as Valgrind — leaks will be
reported for every such subtitle block.

## Expected Behavior
All allocated memory should be freed when a subtitle track
is released.

## Fix
Free `sentence->blockaddition->cue_settings_list` (the
backing message buffer) and `sentence->blockaddition`
inside the loop in `free_sub_track()`.

Start in src/lib_ccx/matroska.c at free_sub_track(), then inspect parse_segment_cluster_block_group_block_additions() to confirm the block_addition and backing message allocations. Release both allocations while freeing WebVTT sentences, then process an MKV with WebVTT BlockAdditions under Valgrind and verify the reported leaks are gone.

Written by the indexing model from the issue text.