sec: restores security.mixed_content.block_active_content (1240)

This preference has been dropped in 5342ec1619 (see #15) but actually
seems to still be disabled by default in Thunderbird. Let's enforce it for the time being.

Closes: #72

user.js

@@ -1,7 +1,7 @@
 /******
 * name: thunderbird user.js
 * date: 28 September 2025
-* version: v128.1
+* version: v128.2
 * url: https://github.com/HorlogeSkynet/thunderbird-user.js
 * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE)
 
@@ -496,6 +496,9 @@ user_pref("security.pki.crlite_mode", 2);
    // user_pref("security.osclientcerts.autoload", true);
 
 /** MIXED CONTENT ***/
+/* 1240: disable insecure active content on https pages
+ * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21323 ***/
+user_pref("security.mixed_content.block_active_content", true);
 /* 1241: disable insecure passive content (such as images) on https pages ***/
 user_pref("security.mixed_content.block_display_content", true); // Defense-in-depth (see 1244)
 /* 1244: enable HTTPS-Only mode in all windows
@@ -1273,7 +1276,7 @@ user_pref("mailnews.headers.showSender", true);
 /* 9121:
  * true=Show User Agent header in message pane
  * false=Does nothing. (default) ***/
-user_pref("mailnews.headers.showUserAgent", false);
+user_pref("mailnews.headers.showUserAgent", true);
 /* 9122: Hello argument
  * Lets you replace your IP address with the specified string in Received: headers when your
  * IP address is not a "fully qualified domain name" (FQDN). Typically you only need to do this