XSS/Privacy protection URL Whitelist for external images by CSP

**Is your feature request related to a problem? Please describe.**

It would be a strong protection against things like this:

https://github.com/gotify/server/security/advisories/GHSA-xv6x-456v-24xh

https://github.com/gotify/server/security/advisories/GHSA-3244-8mff-w398

it would also be useful in cases like you want to see images in a message but not really 100% trust there can never be bad content (an example is if you receive webhook, the sender might not have properly sanitized the markdown)

**Describe the solution you'd like**

A config or admin option to whitelist which URLs can be rendered. On the WebUI we serve a CSP header to prevent images not in the whitelist from being updated. Something like (untested):

`Content-Security-Policy: default-src 'self'; img-src 'self' data: https://my.images.net/; media-src 'none'; script-src: https://gotify/static/js/; style-src: https://gotify/static/css/; style-src-attr 'self' 'unsafe-inline';`

On the Android client we will probably need to implement the same algorithm: https://www.w3.org/TR/CSP/#match-url-to-source-expression

**Describe alternatives you've considered**

An option to globally disable all remote images (will need to rely on the markdown renderer's correctness).

**Additional context**

The logic of interpolating `%CONFIG%` when serving the UI at runtime may need to be refactored. The general idea is to precompute the script content, hash it and write it in the CSP header.