fix #361 with rich OEmbed display via iframe, fix #237 by hiding sensitive
content behind a spoiler on public pages

Fix #205, fix #156, fix #124

Closes: #345

for avatars/headers, resize avatars down to 120x120 instead of 300x300. Set cache headers on S3 stuff, also
make it private (aka only accessible via expiring links to prevent hotlinking)

Fix #233, fix #268

Fix #289 - don't download avatar unless the URL is http/https
Fix #293 - reblog/reblogged is now boost/boosted

Forgot to add `fr` here.

then adjust to failure later if the request fails

skip ActionCable for follow/unfollow/block events, instead clear UI from
blocked account's posts instantly if block request succeeds. Add forgotten
i18n for sensitive content