Switch back to using blob URLs for rendering e2e attachments

[ara4n]

This is based directly on @walle303's PR at #1820, which I assumed was dead due to no feedback after a month. @walle303: thanks for doing all the initial legwork on this!

Reverts 8f778f5

Most of the discussion is on #1820; this extends the original PR to:

• whitelist mime-types to prevent malicious ones being rendered by the browser
• adds revokeObjectURLs to avoid leaking blobs
• fixes the {} on the imports

This fixes element-hq/element-web#2678, element-hq/element-web#2866 (and many dups) and should generally speed up E2E a load.

@dbkr, PTAL - especially in whether my mimetype whitelisting idea is actually sound.

[dbkr]

Yep, I like the idea of whitelisting the mime types. As your comment says, the kicker is whether the browsers actually honour them, but they do seem to.

I still think we should create unqiue-origin object URLs in a sandboxed iframe once browser support allows, but I think this is safe enough for now.

[ara4n]

woo, thanks for reviewing. have opened element-hq/element-web#6639 to track the migration to sandboxed iframes.