v1.7.2

This release also includes v1.7.1, which didn't get a release of its own.

Added (v1.7.1)

• Every page and endpoint now sends a Cross-Origin-Embedder-Policy header.
  • The dashboard uses credentialless, so album art from Last.fm, Spotify, Apple, Deezer and Wikipedia still loads, just without cookies. The stricter require-corp would block those images.
  • The JSON endpoints use require-corp, since they never load anything from other sites.

Changed (v1.7.2)

• The footer's DNSSEC and security-header checks now start with an icon: 🔐 DNSSEC and 🛡️ Security headers.
• The pass/fail mark (✓, ✗, or – if the check couldn't run) now comes after each label instead of before it.