Harden extraction WebView, cache Readability.js, sharpen YouTube thumbs

- Cache the ~90KB Readability.js asset read (identical every time)
  instead of a disk read + UTF-8 decode on the main thread for every
  single extraction.
- Lock down allowFileAccess/allowContentAccess/allowUniversalAccess:
  this WebView runs full JS against any article link, feed URL, or
  (via ShareReceiverActivity) any URL another app hands it -- no
  legitimate reason to ever load file://.
- hq720 thumbnail instead of hqdefault (a letterboxed 4:3 crop).
- Validate frameSrc is actually http(s) before using it verbatim as a
  fallback link -- it's attacker-controlled article content that only
  had to match a substring filter, not the strict video-ID regex, so a
  crafted file://, content://, or intent:// src couldn't ride along
  into an ACTION_VIEW intent or a JS-enabled WebView.loadUrl.

0 files changed, 0 insertions, 0 deletions