* Fix attachments getting processed despite failing content-type validation

* Add a restrictive ImageMagick security policy tailored for Mastodon

* Fix misdetection of MP3 files with large cover art

* Reject unprocessable audio/video files instead of keeping them unchanged

* Tighten allowed HTML in oEmbed-based preview cards

* Sanitize preview cards at render time

* Add `sandbox` attribute to preview card iframes

Co-authored-by: Claire <claire.github-309c@sitedethib.com>

Fix `tootctl accounts cull` crashing when encountering a domain resolving to a private address (#23378)