Cinny displays inline `<img` tags pointing at `mxc` urls from own homeserver in messages regardless of url/media preview settings.

[arachnist]

Describe the bug

If an html message (event with "type": "m.room.message", "content": {"formatted_body":"…"}) contains inline <img tag pointing at mxc:// urls from own homeserver, the images will be rendered inline regardless of url/media preview settings.

Reproduction

Receive a message similar to the following, possibly with media urls replaced

{
  "type": "m.room.message",
  "sender": "@notbot-test:is-a.cat",
  "content": {
    "body": "plain",
    "format": "org.matrix.custom.html",
    "formatted_body": "what if we posted <img src=\"mxc://is-a.cat/WkcBMFCTtLsYkuuHHTwewiCN\"> and <img src=\"mxc://is-a.cat/kebTQWEnXCLUBqmaZBjTzeCW\">",
    "msgtype": "m.text"
  },
  "origin_server_ts": 1745175529759,
  "unsigned": {
    "membership": "join",
    "age": 1765649
  },
  "event_id": "$GgADfTkRQBEP0PJP4tiihYZXmEYVNoFR4j68N-ka2e8",
  "room_id": "!nrKmFDvzkFdQIsvNyH:hackerspace.pl"
}

Expected behavior

Url previews hidden behind a view button.

Platform and versions

1. nixos-unstable x86_64; last updated around 2 weeks ago
2. Firefox 137.0; Floorp 11.25.0 (64-bit); 
3. self-hosted 4.6.0
4. self-hosted synapse, `is-a.cat`

Additional context

Element behaves interestingly in this situation, IMHO closest to being correct. If showing images by-default is enabled, it will render inline images; if inline url previews are enabled, it will show links to the images; if neither of the options is enabled, it will render the message as if the img tags weren't there