Convenience: build a C2PA signer from a cert + key (make_c2pa_signer)

[thorwhalen]

Convenience: build a C2PA signer from a cert + key (make_c2pa_signer)

Signed + embedded C2PA landed in #35 and was validated end-to-end in #38. sign_cert is
dependency-injected — the caller passes a ready c2pa.Signer — which keeps foley off c2pa's
version-fragile signer-construction API. But building that signer is fiddly, and #38 surfaced
real gotchas:

• the private key must be PKCS#8 (BEGIN PRIVATE KEY), not SEC1;
• the cert must be a C2PA-conformant chain (end-entity + CA; KeyUsage=digitalSignature,
  EKU=emailProtection, Subject/Authority Key Identifiers);
• c2pa 0.37's Signer.from_info local-key path rejected an empty TSA URL — Signer.from_callback
  (sign with cryptography, raw r||s) worked cleanly.

Scope

• An optional helper (e.g. foley.provenance.make_c2pa_signer(cert_chain_pem, private_key_pem, *, alg='es256', tsa_url=None)) that builds a working c2pa.Signer (preferring the
  from_callback path that worked), behind foley[c2pa] + cryptography, lazily.
• A make_self_signed_c2pa_certs() test/dev helper (the conformant chain from Verify C2PA signing + rubberband end-to-end; document the signer recipe #38's test) so
  users can try signing without a real CA.
• importorskip-guarded tests; CI stays hermetic.

Acceptance

• foley.weave(..., sign_cert=foley.provenance.make_c2pa_signer(cert, key)) produces a signed,
  embedded, readable C2PA manifest.

Refs #35, #38.