Remove or clarify the “trusted image files” caveat

[DemiMarie]

One of the main features of ImageFlow is security, but this repo states:

Production-ready for trusted image files.

Many interesting applications involve untrusted image files, and this seems like a comment that might be outdated, but I would like to check.

[lilith]

It's as safe as anything that touches images can be, I think. The libwebp vulnerability has been the only issue so far, and that hit every PC, browser, and phone in existence, not just us. We're still sticking with an absolute minimum attack surface area, and continue to migrate more and more codecs to Rust. I'm hoping that by next year we will be off of mozjpeg and libpng completely, as rust codecs for those are progressing nicely towards full file support and decent performance. I'm planning to add avif for output-only, and use a rust decoder for jxl when I add that. Today I'm working on a rust port of jpegli, even though the encoder side isn't really an attack vector.

[DemiMarie]

Could one use sandboxing via WebAssembly? Firefox already does this internally.