Expose bounded manifest parsing (#72)

[sehkone]

Summary

• Add UnparsedContainer::parse_unverified_manifest so callers can decode metadata from read_package_container without reopening the source or providing trust material.
• Preserve the existing bounded read behavior and raw-byte access restrictions while matching open's manifest error mapping.
• Document the unauthenticated trust status and retain the authenticate-then-parse path for callers holding a TrustSet.

Closes #72

Test plan

• Verify unsigned and signed containers parsed through read_package_container produce the same manifest as open, without a TrustSet.
• Verify invalid JSON maps to PayloadError::ManifestParse and an unsupported manifest format maps to PayloadError::InvalidManifest.
• Verify a refused wrong-length signature block does not prevent manifest parsing, and parsing performs no additional source reads or seeks.
• Run cargo build, cargo fmt -- --check --config group_imports=StdExternalCrate, both required clippy configurations, both required test configurations, and RUSTDOCFLAGS=-D warnings cargo doc --no-deps.

[sehkone]

[Reviewer Round 1]

Approved — no findings.

The new public method correctly reuses the retained manifest/footer state and exactly preserves open’s error mapping at src/payload.rs. It neither exposes the raw internal accessors nor performs additional source I/O.

Documentation clearly marks the result unauthenticated and directs TrustSet users to authenticate before parsing. Tests cover external-crate access for signed and unsigned containers, both error categories, refused envelope blocks, and no additional reads/seeks. The PR body properly closes #72 and includes a test plan; the thread contains no stray issue creation.

[sehkone]

[Review Verdict Round 1: APPROVED]