Require provemark/c2pa-verifier 0.7, which refuses a hash that leaves the picture unsigned

Problem/Motivation

provemark/c2pa-verifier 0.6.x reports a file as Trusted when its c2pa.hash.data or c2pa.hash.bmff leaves the picture or the media outside what is signed, with pixels or samples changed after signing. 0.7.0 refuses those. On the verifier route that is a suggestion written for content the signer never signed.

This module asks for the verifier at ^0.6.1 and the library at ^0.19.1, so a site that follows the install sentence on the settings form stays on 0.6. provemark/content-credentials 0.19.2 moves its tested verifier range to ^0.7 and changes no code.

Proposed resolution

Require provemark/content-credentials: ^0.19.2 and ask for provemark/c2pa-verifier: ^0.7 in require-dev, the missing-package message, the install sentence on the settings form and the README. No code changes: nothing here reads the new ValidationStatus::$acknowledged, and the library's verdict for failures is unchanged. The whole suite passes on Drupal 11.3.18 and 11.4.8 with library 0.19.2 and verifier 0.7.0.

Remaining tasks

[x] Fix with tests (SPEC 013 Amendment 4, SPEC 016 Amendment 3, SPEC 019 Amendment 3)