Treat absolute cross-origin attachment API URLs as requiring an authenticated metadata refresh, so draft image previews load on split-origin self-hosted deployments backed by presign-capable or CloudFront-signed storage.
Same-origin URLs (relative or absolute) and external image URLs keep their existing no-refetch path.
Fixes#6049