fix: Allow untrusted failure code to be a Valid validation state

[ok-nick]

This PR changes the Valid validation state logic to accept the untrusted credential failure code for the active manifest.

Should we be checking for the claim signature validated and claim signature inside validity success codes for all of the ingredients too? By extension, should we be checking that all of the ingredients have a trusted success code (rather than only check for no error codes) for the active manifest to be Trusted? See #1624

[codspeed-hq]

CodSpeed Performance Report

Merging #1623 will not alter performance

_{Comparing ok-nick/fix-validation-state (3f475f2) with main (629ab6e)}

Summary

✅ 16 untouched
⏩ 2 skipped¹

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[mauricefisher64]

👍