This is less than ideal, but we still won't end up over-reading because
we're using a LimitedReader here.

Loading remote resources by default has privacy implications.

This reverts commit 02faf6174b.

This commit doesn't work, because it's applied to <img> tags. Making it
handle <a> tags doesn't work either because bluemonday will strip any
target="_blank" attributes, making the compose form open in the
<iframe>. Let's just revert this whole commit for now.

Closes: https://todo.sr.ht/~sircmpwn/koushin/33