Only approve feature requests for the requester's own collection

[pfefferle]

Proposed changes:

• A FeatureRequest is now only accepted if the featured collection (instrument) belongs to the actor who sends the request. Before, the instrument only had to be on the actor's host, so another account on the same server could get a feature approval for a collection that is not theirs.
• The feature policy decides first. If it rejects, the plugin sends the Reject without fetching anything. If it would accept, the plugin fetches the collection and checks that its id is exactly the requested instrument and that its attributedTo is the actor. If not, the request is rejected. FEP-7aa9 requires attributedTo on a FeaturedCollection.
• If the collection can not be fetched, the request is dropped without an answer, like any inbox activity whose fetch fails. activitypub_handled_feature_request does not fire in that case.

Other information:

• Have you written new tests for your changes, if applicable?

Same check as #3881 does for quote requests. It costs one request per FeatureRequest that the policy would accept, the result is cached.

Testing instructions:

• Set activitypub_default_feature_policy to anyone.
• Add your account to a featured collection on Mastodon: the request is accepted as before.
• Send a FeatureRequest whose instrument is a collection of another account on the same server: it is rejected and no stamp is created.

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message

Feature requests are now only approved for collections that belong to the account asking.