Adapt the Lexxy composer to main's link preview hardening

Main strips a javascript: href from a preview node before it's parsed, so
tell legacy Trix attachments apart by their filename instead. escapeHTML
moved to the string helpers, and the unfurling system test now drives
the Lexxy editor.

lib/rails_ext/actiontext_opengraph_embeds.rb

@@ -20,7 +20,7 @@ class ActionText::Attachment::OpengraphEmbed
       # and content-type, so newer attachments carry the details in their
       # content markup instead.
       def attributes_from_node(node)
-        if node["href"].present?
+        if node["filename"].present?
           {
             href: web_url(node["href"]),
             url: web_url(node["url"]),