Add Quality and FitMode to signature.Request, not yet part of the
signed data, and tests that a signature for quality 85 and fit cover is
refused when replayed with another quality or fit: one against
Signer.Verify, one through the image route. The route test also sends
the same signature with no q or fit and with q=85&fit=cover, which must
both pass, and sends URLs built by imgcache.Service.GenerateSignedURL.
The replay cases fail until the next commit.
Model: opus-4-8 (implementation); opus-5-5 (rework)
