Require provemark/c2pa-verifier 0.8, which closes four ways to a wrong Trusted in 0.7

Problem/Motivation

provemark/c2pa-verifier 0.8.0 closes four ways to a wrong Valid or Trusted that are present in 0.7.x: a replaced ingredient manifest could acknowledge its own failures, an ingredient could mark an assertion of the active manifest as redacted, a BMFF hash could leave the offset tables unsigned, and an anchor entry's EKUs were judged at the current time rather than at the time being judged. On the verifier route a wrong Trusted is a suggestion for content the trust check should have refused.

This module asks for the verifier at ^0.7 and the library at ^0.19.2, so a site that follows the install sentence on the settings form stays on 0.7.1. provemark/content-credentials 0.19.3 moves its tested verifier range to ^0.8 and changes no code in src/.

Proposed resolution

Require provemark/content-credentials: ^0.19.3 and ask for provemark/c2pa-verifier: ^0.8 in require-dev, the missing-package message, the install sentence on the settings form and the README. No code changes: nothing here calls a verifier class directly. The whole suite passes on Drupal 11.3.20 and 11.4.11 with library 0.19.3 and verifier 0.8.0.

A site on 1.0.0-alpha1 that uses the verifier route can upgrade without waiting for a release: alpha1 allows library 0.19.3, so composer require provemark/c2pa-verifier:^0.8 is enough.

Remaining tasks

[x] Fix with tests (SPEC 013 Amendment 5, SPEC 016 Amendment 4, SPEC 019 Amendment 4)