Keep the official C2PA trust lists current

Generated with the help of an LLM.

Problem/Motivation

The C2PA Conformance Program says a conforming validator "SHALL regularly refresh the C2PA Trust List". On the verifier route a site's trust is two PEM fields that nothing keeps current.

Proposed resolution

An opt-in setting to fetch the programme's two lists (JSON) once a day on cron, keep the last list the verifier accepts, and show their age on the status report. A Drush command fetches them on demand. The default stays the PEM fields.