fix: restrict thumbnail generation to images in the attachment library

[guqing]

What type of PR is this?

/kind improvement
/area core
/milestone 2.20.x

What this PR does / why we need it:

限制缩略图生成仅针对附件库中的图片，防止任意 URI 的生成行为带来的潜在攻击风险

先 merge #7077 后才能合并此 PR

Does this PR introduce a user-facing change?

限制缩略图生成仅针对附件库中的图片，防止任意 URI 的生成行为带来的潜在攻击风险

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

Attention: Patch coverage is 33.33333% with 4 lines in your changes missing coverage. Please review.

Project coverage is 57.25%. Comparing base (eff73dc) to head (bfd2294).
Report is 65 commits behind head on main.

Files with missing lines	Patch %	Lines
...app/core/attachment/impl/ThumbnailServiceImpl.java	0.00%	3 Missing ⚠️
.../halo/app/content/HtmlThumbnailSrcsetInjector.java	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #7079      +/-   ##
============================================
+ Coverage     56.99%   57.25%   +0.25%     
- Complexity     3999     4010      +11     
============================================
  Files           714      712       -2     
  Lines         24110    24157      +47     
  Branches       1585     1592       +7     
============================================
+ Hits          13742    13830      +88     
+ Misses         9756     9713      -43     
- Partials        612      614       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[JohnNiang]

/lgtm

[f2c-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JohnNiang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [JohnNiang]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment