right now, for animated images, we end up doing _two_ requests because
we're trying to create a static frame if someone wants to pause the
animation.
<img width="1479" alt="Screenshot 2024-06-11 at 16 26 28"
src="https://github.com/tldraw/tldraw/assets/469604/d3d8b93c-7349-4a7f-ba5d-be005a87f2ae">
the problem is that the two requests are slightly different:
1.) there's one request via a JS `Image` call that sets a
`crossorigin="anonymous"`
2.) the other request is the basic image request via setting a
background-image, but this doesn't specify a crossorigin, hence it
causes a separate request.
this converts the image rendering to not use a div+background-image but
to use a regular image tag and make the crossorigin consistent for
animated images. you'll note that we _don't_ set crossorigin for
non-animated and that's because for the new Cloudflare images the
headers don't send back access-control headers (at the moment, until we
want to set up workers).
drive-by cleanup to remove `strict-origin-when-cross-origin` that should
have been removed in https://github.com/tldraw/tldraw/pull/3884
### Change Type
<!-- ❗ Please select a 'Scope' label ❗️ -->
- [x] `sdk` — Changes the tldraw SDK
- [ ] `dotcom` — Changes the tldraw.com web app
- [ ] `docs` — Changes to the documentation, examples, or templates.
- [ ] `vs code` — Changes to the vscode plugin
- [ ] `internal` — Does not affect user-facing stuff
<!-- ❗ Please select a 'Type' label ❗️ -->
- [x] `bugfix` — Bug fix
- [ ] `feature` — New feature
- [ ] `improvement` — Improving existing features
- [ ] `chore` — Updating dependencies, other boring stuff
- [ ] `galaxy brain` — Architectural changes
- [ ] `tests` — Changes to any test code
- [ ] `tools` — Changes to infrastructure, CI, internal scripts,
debugging tools, etc.
- [ ] `dunno` — I don't know
### Release Notes
- Images: avoid double request for animated images.
69e6dbc407