Read only the bytes the type sniffer uses in check_in_media

[abrignoni]

check_in_media reads only the bytes the type sniffer looks at instead of the whole media file.

• For a file on disk the data only feeds guess_mime and guess_extension, and the vendored sniffer uses the first 8,192 bytes, so the sniffer's own get_signature_bytes now does the read. The file is still linked or copied into the report as before.
• On abe_ios16 the artifacts that check in media read 3.03 GiB whole for 7,992 files; the same files now take 59 MiB. A 2 GiB test video took the run to a 2.30 GB peak and now peaks at 0.15 GB, with the same recorded type.
• Every LAVA table and TSV came out identical on otto_ios17, cookbook_a11, thisisdfir_takeout, dleapp_imessage_bigsur and whatsapp_macos. New unit test pins the read size and the recorded type and extension.

Same change in all five cores.

🤖 Generated with Claude Code