FilterHtmlImageSecure considers private:// files insecure

Because:

      // Ensure the path refers to an actual image by prefixing the image source
      // with the Drupal root and running getimagesize() on it.
      $local_image_path = $local_dir . Unicode::substr($src, $base_path_length);
      $local_image_path = rawurldecode($local_image_path);
      if (@getimagesize($local_image_path)) {
        // The image has the right path. Erroneous images are dealt with below.
        continue;
      }

… this assumption is wrong for private:// files, because the image URL looks something like /system/files/inline-images/search.jpg, but that directory does not exist on disk.