chore: bumps to v140.3

This preference has been dropped in 5342ec1619 (see #15) but actually
seems to still be disabled by default in Thunderbird. Let's enforce it for the time being.

Closes: #72

user.js

@@ -1,7 +1,7 @@
 /******
 * name: thunderbird user.js
-* date: 8 November 2025
-* version: v140.2
+* date: 12 September 2026
+* version: v140.3
 * url: https://github.com/HorlogeSkynet/thunderbird-user.js
 * license: MIT (https://github.com/HorlogeSkynet/thunderbird-user.js/blob/master/LICENSE)
 
@@ -470,6 +470,9 @@ user_pref("security.pki.crlite_mode", 2);
    // user_pref("security.osclientcerts.autoload", true);
 
 /** MIXED CONTENT ***/
+/* 1240: disable insecure active content on https pages
+ * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/21323 ***/
+user_pref("security.mixed_content.block_active_content", true);
 /* 1241: disable insecure passive content (such as images) on https pages ***/
 user_pref("security.mixed_content.block_display_content", true); // Defense-in-depth (see 1244)
 /* 1244: enable HTTPS-Only mode in all windows
@@ -1560,6 +1563,9 @@ user_pref("_user.js.parrot", "9400 syntax error: this parrot is talking in codes
  * Whenever RNP fails to decrypt a message, Thunderbird will tray against system GnuPG
  * [1] https://wiki.mozilla.org/Thunderbird:OpenPGP:Smartcards#Allow_the_use_of_external_GnuPG ***/
 user_pref("mail.openpgp.allow_external_gnupg", true);  // [HIDDEN PREF]
+/* 9410: Allow loading of "untested" versions of GPGME (i.e. v2/45 ABI)
+ * [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1967121 ***/
+user_pref("mail.openpgp.load_untested_gpgme_version", "45");  // [TB148+] [TB140.8.0+]
 
 /*** [SECTION 9999]: DEPRECATED / RENAMED ***/
 user_pref("_user.js.parrot", "9999 syntax error: the parrot's shuffled off 'is mortal coil!");