c2pa-v0.90.12

What's Changed

• fix(sdk): Validate inputTo ingredients against manifest tampering (#2… by @mpgopala in #2476
• ci: Reinstate the safe to test label in version-controlled labels (backport #2422) by @caiopensrc in #2423
• update: bump sha1 from 0.10.7 to 0.11.0 (backport #2456) by @caiopensrc in #2473
• fix: Avoid QoS runtime detection warning (backport #2467) by @caiopensrc in #2482
• fix: Preserve identity assertions in split-signing paths (backport #2421) by @scouten-adobe in #2465
• chore: release by @caiopensrc in #2479

Full Changelog: c2pa-v0.90.11...c2pa-v0.90.12