Support SVG sources (closes #68)

The fetcher accepts image/svg+xml; internal/magic detects SVG. orig of
an SVG at the orig size is the SVG unchanged, cached, with a
Content-Security-Policy allowing only its styles and data: images; at
another size, ErrSVGNotOriginalSize (400). Any other format renders it
at the least size covering the output, at most 8192 on a side, so it
stays sharp. Rendering refuses an SVG with a side over 8192 times the
other (ErrSVGTooThin, 415), and the orig size of one above 8192 on a
side (ErrSVGTooLargeForOrigSize, 400). The cache reads up to 1024 first
bytes to find a file's format. Tests pinning the SVG refusal now expect
SVG. Render time and memory are unbounded: P1 in TODO.md until the
owner decides on #68.

Model: opus-5-5

TODO.md

@@ -20,10 +20,15 @@ pre-1.0. The `1.0.0` milestone is in progress.
 
 # Next Step
 
-P2: security: per-origin rate limiting
+P1: security: bound the time and memory of rendering an SVG source. Both grow
+with what the SVG draws, such as filter effects. govips cannot stop or limit a
+render. The bound is the owner's decision on
+https://git.eeqj.de/sneak/pixa/issues/68.
 
 # Future Steps
 
+- P2: security
+    - per-origin rate limiting
 - P2: HTTP response handling
     - Last-Modified headers
 - P2: operational