Warn in the status report about test certificates and a plain-HTTP service

Generated with the help of an LLM.

Problem/Motivation

Two configurations let whoever uploads a file decide what reads as trusted, and the status report calls such a site OK. Both are in the current known issues.

A certificate issued under the C2PA test root. The status report warns when the test root itself is among the trust anchors, but not when a certificate under it is, such as the es256 pair in c2patool's sample folder, whose private key ships with c2patool. Measured with tests/fixtures/signed.png, which that key signed:

• the es256 signer certificate alone as anchor: trusted on the verifier route (not on the extension route);
• the es256 intermediate alone: trusted on both routes.

A reading service at an http:// address on another host. On the service route the service's answer decides trust. Over plain HTTP anyone on the network path can change it. The form accepts such an address and the report does not mention it.

Proposed resolution

• A warning, C2PA test certificate trusted, when the trust anchors (extension or verifier route) hold a certificate issued under the test root and not the root itself, which keeps its existing warning. Recognised by signature, against the test root and the es256 intermediate, so a certificate cannot match by name alone.
• A warning, Reading service over plain HTTP, when the service route's base URL is http:// and its host is not loopback (localhost, *.localhost, 127.0.0.0/8, [::1]). No name is resolved.
• Both read configuration only; malformed anchors or URLs do not break the report; no other entry changes.
• README and CHANGELOG: the sentences saying the report does not warn.

Remaining tasks

• Failing tests, then the code.

Out of scope

• Refusing either configuration in the form or at read time; a test site may run with both on purpose.
• Other test hierarchies than the C2PA test root's.
• Checking anchors set outside the form for whether they parse at all.