feat: image and video blocks

[global-prog]

Summary

Two display-only blocks, so a form can show a picture or point at a video between its questions rather than only text.

They are modelled as ordinary question types that happen to carry no answer, which keeps them inside the existing ordering and drag-and-drop with no new concepts to learn. A shared ANSWER_TYPES_DISPLAY_ONLY list marks them, so they are skipped when validating a submission and filtered out of exports — without that, each block would add an empty column to every CSV.

One deliberate choice: video is a link, not an embed

Embedding would make every respondent's browser contact the video host on page load, disclosing their IP address and usually setting cookies. On a form marked as anonymous that would quietly undermine the promise being made to respondents, so the block renders as a link they choose to follow.

Images do render inline, since that is the point of an image block, but with referrerpolicy="no-referrer" so the form's own address is not passed on. The editor also warns when the address is not on this instance:

This address is on another site. Loading it tells that site the IP address of everyone who opens the form.

I am happy to add an opt-in embed for video if you would rather have it, but I did not think it should be the default.

Scope

• no schema change; the address and description live in the existing extraSettings
• FormsQuestionType is left alone, matching how linearscale, ranking and color are already handled, so openapi.json is unaffected

Testing

• npm run lint, npm run stylelint and php -l clean
• built against current main with no errors
• checked: a block with no address set, an image on this instance, an image elsewhere (warning shown), a video link, submitting a form containing both blocks, and confirming neither appears as a column in the CSV export