Fix #457 - escape JSON in INITIAL_STATE (this bug only ever allowed a user to xss themselves rather than anyone else)

fix bug in process feed service

Deduplicating some logic and switching to pluck, to avoid pulling the entire model in memory.

h-feed, h-card and h-entry

for local attachments, use them in URLs. Check status privacy
before redirecting to actual file.

Add tag property to desktop notifications, preventing duplicates (i.e. when multiple Mastodon tabs are open)

This allows other platforms such as Windows, macOS and iOS to use their system fonts rather than downloading a copy of Roboto. It also makes the app feel a little closer to native on those platforms!