Quote images through the proxy, and unproxy them on the way out (#412) (#413)

Reading a message fetches its remote images through this server, so the
sender learns nothing about the reader. Quoting the same message into a
reply fetched them directly: same pixel, same reader, but the request
carried their IP and user agent -- exactly what the proxy withholds.

A quote now proxies them the way the message view does. That alone would
be wrong, because a proxied URL belongs to this deployment: sent
unchanged it would reach the recipient as images only this server can
serve, broken for them and a beacon back here. So buildEmailObject turns
them back into the addresses they came from, beside the pass that
restores images blocked under pr411 and the one that turns editor blob
URLs into cid: references.

Deployments with the proxy off are unaffected: the quote fetches
directly, as reading does there.

Three tests from pr411 asserted the address sat in src when images were
allowed, which was the old behaviour; they now ask whether the draft
fetches it at all, proxied or not.

No new strings.

FEATURES.md

@@ -446,7 +446,9 @@ minimizable and maximizable; full-screen on mobile.
   allowed them — by policy, by a trusted sender, by the sender being a
   contact, or by *Show images* having been pressed on it. Blocked images keep
   their address and get it back when the reply is sent, so the recipient's
-  copy is the quote as its sender wrote it.
+  copy is the quote as its sender wrote it. Allowed ones are fetched through
+  the server's image proxy, the same as when the message was read, and the
+  sent copy points at their own addresses rather than at this server.
 - **Answering in the format the message was written in.** Replying in plain
   text to a rich text message, or the reverse, loses either the formatting or
   the plain text somebody chose to write in. The composer opens in the default