filepicker_image_tag default read/convert policy with override

Alternative to #95. We've enabled security in our development app and are using this branch for testing. The default policy needs to be `[:read, :convert]` in order to view an image with security enabled. We've also added the ability to override the default policy so a custom expiry, or other options can be set.

Cherry-picked b1dd6f5 from develop in order to get the tests passing.