mumble: fix Mumble-SA-2014-005.

Qt's SVG image plugin is not safe to use with potentially
unsafe SVGs, such as those downloaded over the network.

More specifically, it is possible to trigger local file
access via Qt's SVG renderer using SVG features such as XML
stylesheets (XSL) and SVG image tags, and potentially other
features. This allows an attacker to have Qt read arbitrary
files into the memory space of the Mumble process.

This makes it easy to perform a Denial of Service attack
against a Mumble client. A client DoS can be accomplished
by serving it an SVG file that refers to a filesystem path
that is un-ending or is known to block under certain
circumstances.

Having arbitrary files read into the Mumble process could
potentially also be abused by an attacker to gain access
to the content of the files, if combined with an (as of
yet unknown) vulnerability that allows the attacker to
read Mumble's memory.

To fix the issue, this change removes SVG as a supported
image format for all externally received images. This
includes things such as text messages, user comments,
channel comments and user textures/avatars. It also removes
the ability to transmit SVGs using any of the aforementioned
channels.

This is accomplished by introducing a new class called
RichTextImage. The RichTextImage class is used, via its
isValidImage() method, to validate images before they are used
in a rich text context in Mumble. In its current form, the
isValidImage() method simply checks whether the image's format
is part of the set of image formats that are deemed safe
(PNG, JPG, GIF).

The LogDocument class, which is the QTextDocument that backs
the Mumble log view, undergoes the following changes:

 - LogDocument now restricts images loaded via QNetworkRequest
   and QNetworkReply to those that pass the
   RichTextImage::isValidImage() check.
 - Resources that use the data:// scheme are now loaded via
   QNetworkRequest and QNetworkReply, just like http:// and
   https:// URLs. This allows all resources to make use of
   LogDocument's new image format restrictions.
 - The functionality of the ValidDocument class, a subclass
   of LogDocument that was used to validate HTML snippets,
   is now part of LogDocument itself. The original
   ValidDocument class has been removed.

The RichTextEditor class is used to author text messages
and user comments. The RichTextEditor is changed to use
a LogDocument instead of a regular QTextDocument as its
backing document. This allows the RichTextEditor to benefit
from LogDocument's new image filtering functionality.

The static method Log::validHtml is used to validate
HTML before using it in various contexts such as the Mumble
log view and tooltips. This method is modified to use the
LogDocument class instead of the ValidDocument class.
A call to documentLayout() on the LogDocument is also
added to the method. This ensures that image loading
(and thus validation) is performed.

The MainWindow::openImageFile() method is re-worked to
sniff and validate a selected image using
RichTextImage::isValidImage to ensure that only valid
rich text images can be selected, regardless of file
extension.

The Overlay::verifyTexture() method is used to verify and
set a ClientUser's texture and texture format, either by
reading it from the local cache, or by reqesting a new
texture from the server. This method is changed to only
verify and set textures that pass the
RichTextImage::isValidImage() check.

The ServerHandler::setUserTexture() method (also known as
ServerHandler::setTexture() in some 1.2.x versions of Mumble)
is changed to only allow settings textures that pass the
RichTextImage::isValidImage() check.

Thanks to Tim Cooper for reporting this issue, proposing an
initial patch and reviewing the final patch. This commit has
also been reviewed and iterated upon by Stefan Hacker.