Add `updatedAt` to stalled bubble options so JS can check if the card
was recently updated, matching the `Card::Stallable#stalled?`
logic. Refresh the bubble via Turbo Stream when a step is updated.
This should have been part of #1625
Fixes https://app.fizzy.do/5986089/cards/3668
Instead, let's use a Loofah scrubber which will create DOM nodes
directly. This should be faster and is a tiny bit simpler, as well as
removing a potential HTML injection vector.
Also, add "noreferrer" to all `mailto:` links (already present on URLs).
Remove data-action from the sanitizer allowlist to disallow injection
of potentially malicious Stimulus actions in user-provided
content. The lightbox controller now uses imageTarget callbacks to
handle clicks on image links.
Also add the file name as a caption in the light box, and fix the
caption color for dark mode visibility.
Mike Dalessio