fix: restore ingredient thumbnails with c2pa-web

[timmurphydev]

Overview

Restores ingredient thumbnail rendering. The c2pa-web SDK exposes raw resource bytes via reader.resourceToBytes() and we need to fetch and assign thumbnails explicitly.

• Add resolveThumbnails helper that walks the manifest store and fetches embedded thumbnail bytes, keyed by absolute JUMBF identifier.
• For ingredients with a manifest and claim thumbnail, we use its c2pa.thumbnail.claim assertion.
• Otherwise we fall back to the c2pa.thumbnail.ingredient assertion on the containing manifest, if present.

[timmurphydev]

This update prioritizes the signed ingredient's own c2pa.thumbnail.claim, if present,
over the c2pa.thumbnail.ingredient assertion that the consuming manifest's signer
references via ingredient.thumbnail. When a signed ingredient already provides
its own claim thumbnail, a consuming signer's separate ingredient assertion
thumbnail could be an intentional override pointing at a misleading image. The
claim thumbnail more faithfully represents the ingredient.

When no claim thumbnail is available for an ingredient, we fall back to
c2pa.thumbnail.ingredient only if the containing manifest is trusted. If it is
untrusted, we suppress the thumbnail so an untrusted signer can't force a false
thumbnail to display for an ingredient that has no claim thumbnail of its own. A
signed ingredient's own claim thumbnail is still shown when present (untrusted
state is flagged in the UI).

It solves this kind of issue:

Before:

After: