[ZEPPELIN-6751] Prevent automatic image requests in AI Assistant answers

[miinhho]

What is this PR for?

Addresses the image-loading follow-up raised in #5570.

Model-generated Markdown can include image URLs containing notebook data. Loading these images automatically sends a request to the destination without user interaction.

This PR replaces automatic image loading with a Load image button. Before loading, the reader can review the image description, destination host, full URL, and a warning that the request may transmit information from the answer. Only HTTP(S) image URLs are supported.

Approval is specific to each image in an answer. Unchanged images retain approval during streaming, including when a reference definition gains a title. Changing the destination or removing and restoring an image requires fresh approval.

What type of PR is it?

Bug Fix

What is the Jira issue?

• https://issues.apache.org/jira/browse/ZEPPELIN-6751

How should this be tested?

From zeppelin-web-angular/projects/zeppelin-react, run:

npm test -- src/entities/assistant/ui/MarkdownAnswer.spec.tsx
npm run typecheck
npm run build:storybook
npm run test:storybook -- markdown-answer-images.spec.mjs

For manual verification, run npm run storybook and open Assistant / MarkdownAnswer:

1. In Image Loading, inspect the browser’s Network panel. Confirm that no image request is sent before activation. Use Enter or Space to activate Load image and confirm that only the selected image loads.
2. In Streaming Images, load the image and append the next chunk. Confirm that the image remains loaded while its destination is unchanged. When a later chunk changes the destination, confirm that the new URL is displayed and requires another activation before loading.
3. Using the image story’s content control, remove an approved image and restore the same Markdown. Confirm that it requires approval again.

Questions

• License changes? No.
• Breaking changes? No.
• Documentation? The React README explains image loading and the destination warning.

[voidmatcha]

@miinhho #5570 is merged, so I switched the base to master. This PR still carries its own copy of the #5570 commits, which now conflict with the squashed #5570 on master. Could you drop them by rebasing onto master and force-pushing?

git fetch https://github.com/apache/zeppelin.git master
git rebase --onto FETCH_HEAD 2d3bdd26c
git push --force-with-lease

That leaves only your two image-policy commits and 9 files, with no conflicts. Please also drop the "Depends on #5570" line from the description. I'll review it after that.

[voidmatcha]

Merged into master (0d344fb).