Fix #11969

* Change domain blocks to automatically support subdomains

If a more authoritative domain is blocked (example.com), then the
same block will be applied to a subdomain (foo.example.com)

* Match subdomains of existing accounts when blocking/unblocking domains

* Improve code style

Fix #11016

An explicit error allows user agents to know the error and Sidekiq to
retry.

* Fix incomplete account records being read

- Put account processing into redis lock
- Do not save until record is complete

* Fix spaces

* When accessing uncached media attachment, redownload it

* Prevent re-download of rejected media