Policy on shields and other trusted images in README

[alex-key]

Describe the bug

Many repositories have shields in their readme. Some commonly used shields are not rendered properly.
Also many OSS repos use OpenCollective SVGs, scarf tracking pixel and other trusted images, which should be properly handled by npmx.

Steps to reproduce:

• Go to https://npmx.dev/package/nuxt
• Scroll to Readme preview and check shields under the banner
• securityscorecards and DeepWiki are not rendered

More examples:

• badgesize.io badges - gzip/brotli size: https://npmx.dev/package/preact#user-content-more-information-at-the-preact-website
• OpenCollective SVG images: https://npmx.dev/package/solid-js#user-content-contributors. GitHub does not render big Contributor badge on this page it as well. But it renders Sponsors,
• scarf tracking pixel: https://npmx.dev/package/@tanstack/react-start . GitHub allows it. We should probably have a specific policy about it: either remove it from readme render or allow it, otherwise it looks a bit weird
• trusted image storages like: *.githib.io, *.storage.googleapis.com, assets.vercel.com . See: https://npmx.dev/package/solid-js#user-content-browser-support, https://npmx.dev/package/next,

Additional context

[alex-key]

Related: #1730, #1745

[sarah11918]

Just adding another badge I found:

(And, from #1745 ):

[alexdln]

imo could be trusted:

• 'api.securityscorecards.dev',
• 'deepwiki.com',
• 'saucelabs.github.io',
• 'opencollective.com',
• 'circleci.com' (example)
• 'avatars2.githubusercontent.com' and 'cloud.githubusercontent.com' (*.githubusercontent.com?)
• 'www.codetriage.com' https://www.codetriage.com/axios/axios/badges/users.svg
• 'badges.gitter.im' https://badges.gitter.im/Join%20Chat.svg
• 'data.jsdelivr.com' https://data.jsdelivr.com/v1/package/npm/async/badge?style=rounded
• 'nodei.co' https://nodei.co/npm/array.prototype.flatmap.png?downloads=true&stars=true
• 'travis-ci.org' https://travis-ci.org/jeromeetienne/AR.js.svg?branch=master
• 'secure.travis-ci.org' https://secure.travis-ci.org/nodeca/argparse.svg?branch=master

Not sure:

• https://discordapp.com/api/guilds/340160225338195969/widget.png

Examples with other sources:

• https://npmx.dev/package/embla-carousel-auto-scroll
• https://npmx.dev/package/vuetify - cdn.vuetifyjs.com
• https://npmx.dev/package/axios
• https://npmx.dev/package/ajv

[teplostanski]

Badges shields.io still not displayed

[alex-key]

Badges shields.io still not displayed

Probably open another issue to track more of these. Thanks!