gamut-xmp/gamut-metadata: report remote provenance from dcterms:provenance

[justin13888]

Part of #239 — one of its acceptance criteria, with no child issue until now. Blocked by #428.

Goal

A file with no embedded manifest store but a dcterms:provenance URL in its XMP must report
remote provenance, not none.

Why this is its own issue

Every other slice of #239 is about bytes inside the file. This one is about a file that has none:
the manifest lives at a URL, and the only trace in the asset is an XMP property. A caller asking
"does this image have Content Credentials?" gets the wrong answer — a confident no — unless the
facade distinguishes the three states.

gamut-xmp has no dcterms support today (grep dcterms crates/gamut-xmp/src/ is empty), so
this issue adds the namespace as well as the lens.

Scope

• The property. dcterms:provenance, namespace http://purl.org/dc/terms/, holding the URL of
  an external manifest (§11.5, §15.5.3.1).
• It is for external manifests only. §15.5.3.1 is explicit that this key indicates an
  external manifest. A file carrying both an embedded store and a dcterms:provenance URL is
  a real case (the URL may point at an updated manifest) — report both, and do not let the presence
  of one suppress the other.
• Three states, not two. Whatever surface reports this — most naturally a small enum on the
  facade or beside Metadata::c2pa — must distinguish Embedded / Remote / None, so a caller
  cannot collapse the first two into a boolean by accident. Remote carries the URL.
• gamut does not fetch it. Resolving the URL is a validator's job and a network operation; the
  workspace ships neither. Say so where the variant is defined.
• Also record the Link header route. §15.5.3.2 defines an HTTP Link relation carrying the
  same information for an asset served over HTTP. That is out of scope for a file-format library
  and should be documented as deliberately out of scope, not silently omitted.

Where it lands

gamut-xmp gains the namespace and the property; the reporting lens belongs on gamut-metadata,
beside Metadata::c2pa, since it answers the same caller question. It is not a new carrier —
the property lives inside the XMP graph, exactly as IPTC does.

Semver

Minor for both crates — the metadata structs are #[non_exhaustive].

Reference

C2PA Technical Specification 2.4 §11.5 (external manifests), §15.5.3.1 (dcterms:provenance, and
that it is for external manifests), §15.5.3.2 (the Link header route, out of scope). Staked
by #427. Namespace: DCMI Metadata Terms, http://purl.org/dc/terms/.