fizzy@493706c

What's Changed

• SSRF: take the address policy from surfguard instead of keeping our own copy by @jeremy in #3026
• Guard Gemfile against bundling under the wrong Ruby by @jeremy in #3041
• dep: bump image_processing, ruby-vips, mini_magick by @flavorjones in #3051
• Bump bootsnap to 1.24.6 (security) by @jeremy in #3022
• Remove the dead User::Transferable concern by @jeremy in #3030
• Bump the github-actions group across 1 directory with 5 updates by @dependabot[bot] in #3035
• Serve static public pages with a locked-down CSP by @jeremy in #3031
• Bump aws-sdk-s3 from 1.219.0 to 1.229.0 by @dependabot[bot] in #2916
• Bump jbuilder from 2.14.1 to 2.15.1 by @dependabot[bot] in #2920
• Update lexxy to 0.9.31 by @jorgemanrubia in #3052

Full Changelog: https://github.com/basecamp/fizzy/compare/fizzy@36fb8ee...fizzy@493706c