Drag&Drop protection improvements

Drag&Drop protection has been restored by torbutton!106 (merged), but discussion on how improve it balancing security and usability went on in #41353 (closed) and torbutton!107 (closed).

Since torbutton is now in-tree (requiring a new MR) and the discussion is not done yet, moving it here.