chore: Add CI and release-plz workflows adapted from c2pa-cbor

[scouten-adobe]

Changes in this pull request

Adds CI and release automation for this crate, adapted from the peer project contentauth/c2pa-cbor.

Workflows (.github/workflows/)

• ci.yml:
  • unit tests with code coverage on Windows, macOS and Linux, using stable Rust and the 1.87.0 minimum version
  • doc tests
  • cross-compiled tests for aarch64 Linux
  • tests on the iOS simulator
  • Wasm and WASI tests
  • tests against the minimum versions of direct dependencies
  • a dry run of cargo publish
  • clippy and nightly rustfmt checks
  • TOML formatting check with taplo
  • a docs.rs build preflight
  • cargo-deny license and vulnerability audit
  • Omitted from c2pa-cbor's version: the benchmark job (this crate has no benchmarks yet) and the unused-dependency check (this crate has no dependencies).
• release.yml: release-plz.
• pr_title.yml: checks that PR titles follow Conventional Commits.
• All actions are pinned to full commit SHAs, with the original ref kept as a trailing comment.

Config: release-plz.toml, .commitlintrc.yml, codecov.yml, deny.toml, .taplo.toml, rustfmt.toml, dependabot.yml, the PR template, CONTRIBUTING.md and CODE_OF_CONDUCT.md.

Code changes needed to pass the new checks

• Reformatted with nightly rustfmt and taplo.
• Fixed four rustdoc warnings that failed the docs.rs preflight with -Dwarnings.
• Turned off unit tests that WASI can't run: four that spawn threads, plus one that needs panics to unwind (WASI builds with panic=abort).
• Converted the CHANGELOG headings to release-plz style and updated the copyright year in the license files.

Requires the org secrets RELEASE_PLZ_ORG_TOKEN, CRATES_IO_ORG_TOKEN and CODECOV_ORG_TOKEN.

Checklist

• This PR represents a single feature, fix, or change.
• All applicable changes have been documented.
• Any TO DO items (or similar) have been entered as GitHub issues and the link to that issue has been included in a comment.