Support SVG sources (closes #68)

The fetcher accepts image/svg+xml; internal/magic detects SVG. orig of
an SVG at the orig size is the SVG unchanged, cached, with a
Content-Security-Policy allowing only its styles and data: images; at
another size, ErrSVGNotOriginalSize (400). Any other format renders it
at the least size covering the output, at most 8192 on a side.
Rendering refuses an SVG with a side over 8192 times the other
(ErrSVGTooThin, 415), and the orig size of one above 8192 on a side
(ErrSVGTooLargeForOrigSize, 400). Child processes of pixad read an
SVG's size and render it, killed after 20 seconds and limited to 1 GiB;
any failure there is ErrSVGRenderFailed (415). Tests pinning the SVG
refusal now expect SVG.

Model: opus-5-5

cmd/pixad/main.go

@@ -1,10 +1,21 @@
-// Package main is the entry point for the pixad image proxy server.
+// Package main is the entry point for the pixad image proxy server. pixad
+// also runs as a child process of itself, to read the size of an SVG source
+// or to render it (see imageprocessor.RunAsSVGChildProcess).
 package main
 
-import "sneak.berlin/go/pixa/internal/app"
+import (
+	"os"
+
+	"sneak.berlin/go/pixa/internal/app"
+	"sneak.berlin/go/pixa/internal/imageprocessor"
+)
 
 var Version string //nolint:gochecknoglobals // set by ldflags
 
 func main() {
+	if imageprocessor.IsSVGChildProcess(os.Args[1:]) {
+		os.Exit(imageprocessor.RunAsSVGChildProcess(os.Args[1:]))
+	}
+
 	app.Run(Version)
 }