Update the README and composer.json for recent c2patool releases

Part of #3596034 (closed).

Problem/Motivation

The README installs c2patool with --version=^0.9.1. c2patool 0.9 cannot read C2PA 2.x files, so their credentials are lost on re-signing. The composer.json still allows jrglasgow/c2patool 0.5.1 and 0.5.2, which break the claim generator icon on c2patool 0.27 and later.

Tested on a site with c2patool 0.9.12, 0.10.2, 0.20.0, 0.27.22 and 0.28.2: 0.10.2 and 0.20.0 fail with the current manifest, so 0.27 is the lowest version that works.

The prebuilt c2patool 0.27 and 0.28 binaries need glibc 2.38. They do not start on Debian bookworm, the base of most PHP images.

Proposed resolution

• README: require c2patool 0.27 or later and jrglasgow/c2patool 0.5.3 or later, install with --version=^0.28, show 0.28 in the status report example.
• README: say that cargo install is needed where the prebuilt binary does not start.
• composer.json: jrglasgow/c2patool: ^0.5.3.

Definition of done

• README states c2patool 0.27 or later and jrglasgow/c2patool 0.5.3 or later
• README install command uses ^0.28 and mentions the glibc limit
• composer.json requires ^0.5.3 and passes composer validate

Testing instructions

1. On a site with jrglasgow/c2patool 0.5.2, run composer update drupal/c2pa_sign -W. Composer installs 0.5.3 or later.
2. In a php:8.3-cli (bookworm) container, follow the README install steps. c2patool --version prints 0.28.x.
3. Open /admin/reports/status. The c2patool row shows the same version.

AI Compliance

🤖 Generated with the help of an LLM, reviewed and approved by me before posting.