add C2PA support

Discussed in https://github.com/libvips/libvips/discussions/4233

^{Originally posted by timbray October 31, 2024}
C2PA's official home is at https://contentauthenticity.org, the open-source software is at https://github.com/contentauth/c2patool, more depth at https://contentcredentials.org, slightly more human-readable explanatory blogs (from me) at https://www.tbray.org/ongoing/When/202x/2023/10/28/C2PA-Workflows and https://www.tbray.org/ongoing/When/202x/2024/10/29/Lane-Provenance

Tl;dr: PKI-based provable provenance for media files. Extra goodies: Details about what devices and software were involved in creating/manipulating the image.

Disclosure: No relationship with any of the C2PA organizations, just a photographer who cares about provenance and disinformation.

In a world with a lot of C2PA, what libvips should do is straightforward: Write a C2PA manifest into the EXIF saying the image was updated with libvips and some info about what was done. For extra credit, insert some identity information, e.g. a social media account, there are plenty of easy-to-access identity providers people might want to use. If there was already a C2PA manifest there do the right signature-chain things.

Start with the linked libvips discussion and the C2PA resources listed in the issue to understand the required manifest and signing behavior. Done means defining how libvips records its operation in an image's EXIF, handles identity information, and preserves or extends an existing C2PA signature chain.