* Fix timeout handling of outbound HTTP requests

* Use CLOCK_MONOTONIC instead of Time.now

* Fix attachments getting processed despite failing content-type validation

* Add a restrictive ImageMagick security policy tailored for Mastodon

* Fix misdetection of MP3 files with large cover art

* Reject unprocessable audio/video files instead of keeping them unchanged

* Tighten allowed HTML in oEmbed-based preview cards

* Sanitize preview cards at render time

* Add `sandbox` attribute to preview card iframes

Co-authored-by: Sam BC <samuel.balbirnie-cumming@xdesign.com>

Co-authored-by: Eugen Rochko <eugen@zeonfederated.com>

Co-authored-by: Claire <claire.github-309c@sitedethib.com>