v1.11.0

Links in messages are links.

A web address or an email in a Signal message used to be text you retyped, and in the
browser it was text on both rails. Now it is something you tap, in all four places — the SMS
thread, the Signal thread, and both of them in Desktop Sync.

The three ways of handling a link are unchanged and now mean the same thing everywhere.
Ask before opening, which is the default, shows you the address and waits. Never open
leaves the text exactly as it arrived. Always open hands it to the browser.

That last one was broken. Links were only ever made clickable on the Ask path, so choosing
"Always open links" — the setting that sounds most permissive — quietly produced no links at
all. If you picked it and wondered why nothing was tappable, that is why, and it works now.

In the browser the links are built out of text, never out of markup, and only a web or email
address is allowed to become one. A message body is the one thing on that page written by
somebody else, and a page that parses it as markup is a page where a text someone sends you
can run code. A <script> tag or a javascript: address in a message stays visible text and
does nothing.

Two smaller things from the same read-through. The Signal account screen used to describe the
device that is the account as "unnamed" — a registered bridge has no name, because Signal
only asks for one when a device is linked — and now says "this bridge". And Mark all read has
left the settings list, since the selection menu already has it, while Storage and privacy
has moved above Desktop Sync and Signal.

Full Changelog: v1.10.0...v1.11.0