fix: #3629376 Carry the media setup from the removed drupal_cms_media

Issue: https://www.drupal.org/i/3629376 (parent: https://www.drupal.org/project/horizonaid/issues/3629200)

Why: since Drupal CMS 2.2.3 (7 October 2026) a fresh drupal/cms requires drupal/tagify ^2.0.4. Drupal CMS 2.2 removed drupal_cms_admin_ui, drupal_cms_content_type_base, drupal_cms_media and drupal_cms_privacy_basic (drupal.org lists them as replaced by Drupal CMS Basics). Their last releases (2.1.6) require Tagify 1, so the Vardot site templates can no longer be installed from the Drupal CMS installer. Varbase carries the pieces itself instead of switching to Drupal CMS Basics (drupal_cms_site_template_base): applied first, that recipe would take over Varbase's own metatag defaults and the page and media displays (20 configuration items differ).

Change:

• Carry what drupal_cms_media 2.1.6 set up: the SVG image and document media types, responsive image styles and view modes, the focal point widget, bulk upload, file delete and the media ECA models.
• Require the module packages, so existing sites keep them.

Tested on DDEV today, with all the related branches together:

• Fresh Drupal CMS 2.2.3 (Tagify 2.0.4): Horizon Aid installs by drush and through the browser installer; Educare, The Rightup and Varbase Starter install by drush. None of the removed drupal_cms recipes is pulled in.
• Varbase base (drupal/varbase_project 11.0.x-dev, Tagify 1.2.54): Horizon Aid installs by drush.
• YAML lint and composer validate pass on every package.

Visible difference: Varbase's own remote video displays and media view mode labels now take effect. Until now drupal_cms_media's versions were created first and Varbase's were skipped.

Merge order: the six Varbase recipe MRs first, then the site template MRs.

Related: Varbase Content Base !37, Varbase Editor Base !25, Varbase Security Base !14, Varbase Admin Base !35, Varbase Page Base !14, Educare !82, Horizon Aid !104, The Rightup !77, Varbase Starter !70.

AI-Generated: Yes

Checkpoints:

• File an issue
• Addition/Change/Update/Fix
• Testing to ensure no regression
• Automated unit testing coverage
• Automated functional testing coverage
• UX/UI designer responsibilities
• Readability
• Accessibility
• Performance
• Security
• Developer Documentation
• User Guide Documentation
• Reviewed by human
• Code review by maintainers
• Full testing and approval
• Credit contributors
• Review with the product owner
• Release notes snippet
• Release