Release/2.2.0

See merge request pleroma/secteam/pleroma!19

Validate the content-type of the response when fetching an object,
according to https://www.w3.org/TR/activitypub/#x3-2-retrieving-objects.

content-type headers had to be added to many mocks in order to support
this, some of this was done with a regex. While I did go over the
resulting files to check I didn't modify anything unrelated, there is a
 possibility I missed something.

Closes pleroma#1948

Title injection change

See merge request pleroma/pleroma!3132

Ingest blurhash for attachments if they were federated

Closes #2294

See merge request pleroma/pleroma!3133

little changes for MRF config descriptions

See merge request pleroma/pleroma!3131

- log level reduction, if policy doesn't implement config_description method
- docs in dev.md

Config descriptions for custom MRF policies

Closes #2222

See merge request pleroma/pleroma!3128

- revert UserAllowPolicy description
- MRF descriptions order

Resolve "Wrong user link in Report email"

Closes #2260

See merge request pleroma/pleroma!3121

Fix title on load of Pleroma HTML, fixes #2281

Closes #2281

See merge request pleroma/pleroma!3125

Escaping in xml templates

Closes #2291

See merge request pleroma/pleroma!3126

Remove release_env

See merge request pleroma/pleroma!3124

While taking a final look at instance.gen before releasing I noticed
that the release_env task outputs messages in broken english. Upon
further inspection it seems to have even more severe issues which, in
my opinion, warrant it's at least temporary removal:
- We do not explain what it actually does, anywhere. Neither the task
 docs nor instance.gen, nor installation instructions.
- It does not respect FHS on OTP releases (uses /opt/pleroma/config even
 though we store the config in /etc/pleroma/config.exs).
- It doesn't work on OTP releases, which is the main reason it exists.
Neither systemd nor openrc service files for OTP include it.
- It is not mentioned in install guides other than the ones for Debian
and OTP releases.

Fix object spoofing vulnerability in attachments

See merge request pleroma/secteam/pleroma!18

Resolve "Account cannot be fetched by some instances"

Closes #2236

See merge request pleroma/pleroma!3101

OStatus / Static FE access control fixes

See merge request pleroma/pleroma!3053

[#1668] App metrics endpoint (Prometheus) access restrictions

Closes #1668

See merge request pleroma/pleroma!3093

Resolve "Posts tagged with #NSFW from GS aren't marked as sensitive"

Closes #2242

See merge request pleroma/pleroma!3094

[#2261] FrontStatic plug: excluded invalid url

See merge request pleroma/pleroma!3106