v0.9.1: padding after the last box is not a truncation

• A few bytes of padding after the last box no longer bring the byte scan back. v0.9.0 followed #371 in scanning a container's raw bytes for C2PA markers only when its box walk stopped early, but the test was "stopped before the end of the file". The walk needs 8 bytes to read a box header, so a complete MP4, AVIF or HEIC with 1 to 7 bytes of trailing padding passed it, and a c2pa that happened to sit in the media was reported as a manifest. guillaumemeyer/watermarks-remover#382 asks for at least 8 bytes left over, the same threshold the cleaners already use to tell a truncated file. Both drivers follow it. A real truncation, including a content-provenance box cut off before any ASCII marker, is still caught.
• 1778 tests, twelve upstream anchors, one of them moved to upstream c5297e9.

Ports upstream guillaumemeyer/watermarks-remover at c5297e9. Closes #31.