Authenticate media requests when loading avatars

[Half-Shot]

Fixes #2845

This introduces support for authenticated matrix media for avatars. All media requests are now made via fetch and then the result is stored as a local object url.

[hughns]

What is the intended behaviour when EC is running as a widget?

[Half-Shot]

What is the intended behaviour when EC is running as a widget?

😢 , I suspect. There isn't an API presently to fetch media over the widget API and we don't have a token to use that could do it. I wish for a world where we get scoped OIDC tokens and can just use the actual API. matrix-org/matrix-widget-api#115 would be useful.

I think for the moment we could either still support unauthenticated media for widgets while new avatars slowly replace the old ones and we lose access to them. Or we could just show placeholders for all avatars until we can properly support authenticated media.

[hughns]

What is the intended behaviour when EC is running as a widget?

😢 , I suspect. There isn't an API presently to fetch media over the widget API and we don't have a token to use that could do it. I wish for a world where we get scoped OIDC tokens and can just use the actual API. matrix-org/matrix-widget-api#115 would be useful.

I think for the moment we could either still support unauthenticated media for widgets while new avatars slowly replace the old ones and we lose access to them. Or we could just show placeholders for all avatars until we can properly support authenticated media.

If the PR can be updated to make it work with the widget mode fallback (with appropriate tests too), then I think we could merge this PR without having to figure out the whole widget API solution.