Fix PR review feedback

- Preserve SSRF protection by wrapping the existing transport
  instead of replacing it with a bare http.Transport
- Strip DSN from url.Parse error to avoid leaking credentials
- Gate CommonThirdPartyCombobox on search length to prevent
  showing stale results when input is shortened
- Handle multi-value and uppercase sizes attributes in
  parseSizeAttr for correct icon-size ranking
- Match rel tokens containing "icon" (e.g. "shortcut icon")
  instead of requiring an exact match
- Limit HTML response body to 10 MiB before parsing
- Reject sslmode=prefer explicitly in both import tools

Signed-off-by: Émile Ré <emile@getprobo.com>

cmd/geoloc-import/main.go

@@ -82,10 +82,12 @@ func newPgClientFromDSN(dsn string) (*pg.Client, error) {
 	switch u.Query().Get("sslmode") {
 	case "", "disable":
 		// plain connection, no TLS
-	case "require", "prefer":
+	case "require":
 		opts = append(opts, pg.WithUnsecureTLS())
+	case "prefer":
+		return nil, fmt.Errorf("unsupported sslmode %q (prefer fallback semantics are not supported)", u.Query().Get("sslmode"))
 	default:
-		return nil, fmt.Errorf("unsupported sslmode %q (only disable, require, prefer are supported)", u.Query().Get("sslmode"))
+		return nil, fmt.Errorf("unsupported sslmode %q", u.Query().Get("sslmode"))
 	}
 
 	if u.Host != "" {