Test against provemark/c2pa-verifier 0.8.1, which fixes two wrong Trusted verdicts in 0.8.0

Problem/Motivation

provemark/c2pa-verifier 0.8.1 fixes two ways to a wrong Trusted that are present in 0.8.0. When two ingredient assertions named the same manifest, only the first one's hash was compared. And an ingredient whose references led back to the active manifest could still mark one of its assertions as redacted. 0.8.1 also no longer lets an ingredient record acknowledge a cyclic reference. On the verifier route a wrong Trusted is a suggestion for content the trust check should have refused.

This module asks for the verifier at ^0.8, which already allows 0.8.1, so a new install gets it and the requirement does not need to change. A site that installed the verifier before 24 October 2026 should update it. The module's own composer.lock still has 0.8.0.

Proposed resolution

Move the lock to verifier 0.8.1, run the whole suite on Drupal 11.3 and 11.4, and add a Security entry under Unreleased in the CHANGELOG that tells sites on the verifier route to run composer update provemark/c2pa-verifier. No code or spec changes.

Remaining tasks

[x] Suite and CHANGELOG (the lock is not tracked here)