Add damrs_image_style: render an asset from a signed URL

Add damrs_image_style: render an asset from a signed URL The piece that finally puts a picture on a page. A field formatter renders the media source field as an whose URL is signed locally, so painting a page still makes no request to damrs and an outage upstream leaves a stale page rather than a blank one. Verified by rendering a real media entity and feeding the resulting token back through verify_token: it decodes with the mapped transform and every field correct. **A mapping, not a translation, and that follows from damrs rather than from Drupal.** The obvious design reads an image style's effects — scale to 800, crop to a ratio, convert to WebP — and emits the equivalent transform. It cannot work: a transform is a name, and an unrecognised one is refused rather than approximated. So a site says which of the transforms damrs does render each of its image styles corresponds to, which is a decision about intent rather than arithmetic. A site wanting a size damrs does not offer adds a conversion there and maps to its key, which keeps one place deciding what renditions exist. **The cache lifetime is the URL lifetime.** A render array cached for longer than the signed URL's TTL becomes, after that TTL, a cached page whose every image damrs refuses — and nothing in the logs connects the two. The formatter caps its own max-age at the configured TTL rather than leaving an operator to keep two unrelated numbers in the right order by hand. Making the render permanent fails the suite. The formatter is offered only on the source field of a damrs media type, not on every string field on the site, because a formatter that puts a broken image where somebody expected their text is worse than one that is absent. 9 kernel tests, 95 assertions. phpcs --standard=Drupal,DrupalPractice clean.