Add damrs_media: a media type that references a damrs asset

Add damrs_media: a media type that references a damrs asset The damrs_asset MediaSource holds an asset id in a plain string field and nothing else. The bytes never enter sites/default/files, which is not a storage optimisation: it is what makes rights authoritative. When a licence expires in the DAM the image stops rendering on the site, because every rendered URL is resolved by damrs at fetch time. Had Drupal copied the file in, expiry in the DAM would be cosmetic and an expired-licence image would sit on a live site indefinitely. **The hazard was not in the plugin, it was in how Drupal calls it.** Media::preSave() assigns whatever getMetadata() returns straight into the mapped field. A source returning NULL because damrs was unreachable would therefore blank the cached title, alt text and dimensions of every item re-saved during an outage. Stale metadata is the correct degraded state; empty metadata is silent data loss. So the plugin falls back to the value already in the mapped field, and to the thumbnail the item already has. **A test that was wrong before it was right.** The first version created a new entity with values already set and concluded the fallback worked. It did not: Drupal re-reads metadata only when a mapped field is empty or the source field changed, so nothing had called getMetadata at all and the values survived because nothing touched them. Removing the fallback changed nothing, which is how the bad test was caught. The real case — an existing entity whose asset id changes during an outage — fails without the fallback and passes with it. **Two defects only a live Drupal produced.** There was no config schema for the source's source_configuration, so media.type.* failed Drupal's schema check and a site with strict checking could not create the media type at all. And an earlier commit had to fix 129 coding-standard violations. Neither is reachable by reading the code. getMetadata() may call the API because Drupal calls it at save time, never at render time; the transform URLs a template renders come from the local signer, which cannot fail on the network. The asset is fetched once per save rather than once per mapped attribute. CI gains a kernel-plus-standards job. The existing signing job stays separate and fast because it needs no Drupal at all.