Issue #3590005: Validate remote images using response metadata and image content

Nick Hoperequested to merge
3590005-validate-remote-images into 3590480-thumbnail-image-style

Adds content-based validation for Remote image URLs.

Instead of validating only by file extension in the URL, the module now fetches the submitted URL/path and checks whether it resolves to valid image content.

This MR:

  • validates submitted Remote image URLs using HTTP response data and image content
  • supports valid image URLs without file extensions
  • rejects URLs that return HTML, missing files, or other non-image content
  • checks every item in multi-value Remote image URL fields
  • allows existing unchanged Remote image URLs to be re-saved without forcing revalidation
  • derives thumbnail filename extensions from response content when the URL has no usable extension
  • fixes internal styled-image path handling for paths such as /sites/default/files/styles/.../*.png.webp?itok=...
  • updates README documentation

Manual testing in Drupal 10 and Drupal 11:

  • normal image URLs save successfully
  • extensionless image URLs such as https://picsum.photos/id/1025/200/200 save successfully
  • local thumbnails are generated for extensionless image URLs when thumbnail generation is enabled
  • non-image URLs such as https://example.com/ are rejected
  • missing image URLs are rejected
  • multi-value fields reject invalid image URLs in later values
  • existing media can be re-saved when the URL is unchanged
  • internal styled-image paths validate correctly

Merge request reports