Liferea internal browser's Javascript should be disabled by default

Reported by user.

Liferea RSS reader comes with an internal browser. Javascript can be disabled on it, but comes enabled by default in Tails.

User claims that no RSS feed uses Javascript and that this can lead to a zeroday because the feeds don’t do TLS.

Can somebody have a look at this?

Original created by @emmapeel on 9429 (Redmine)

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information