sec: restores security.mixed_content.block_active_content (1240)

This preference has been dropped in 5342ec1619 (see #15) but actually
seems to still be disabled by default in Thunderbird. Let's enforce it for the time being.

Closes: #72

user.js

@@ -496,6 +496,9 @@ user_pref("security.pki.crlite_mode", 2);
    // user_pref("security.osclientcerts.autoload", true);
 
 /** MIXED CONTENT ***/
+/* 1240: disable insecure active content on https pages
+ * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21323 ***/
+user_pref("security.mixed_content.block_active_content", true);
 /* 1241: disable insecure passive content (such as images) on https pages ***/
 user_pref("security.mixed_content.block_display_content", true); // Defense-in-depth (see 1244)
 /* 1244: enable HTTPS-Only mode in all windows