I have removed:
- Flash (all browsers are now or soon going to be asking permission to run it per-page-load); see #2778 for exceptions I defined
- Quicktime (Quicktime Player for Windows is no longer supported and insecure; modern versions of QuickTime are just fronts for h.264 which we support directly)
- RealPlayer (justification: it's effectively dead, no major vendor has been pushing it for years, and it was only ever really popular as a streaming format commercially; I think there's zero legacy interest)
- VRML (it's not been used in very many years)

I have not removed:
- Windows Media Player (it's still very possible people will be using it, which isn't great but Windows is the most popular OS and I'm not aware of Microsoft have fully shifted everyone over to h.264 yet in their production tools; there are so many .avi files around too)

Also special cases:
- I have not (except for Flash) removed mime types. I think it's still legitimate for people to upload RealPlayer files and accept the right mime type to be used. If the browser then directs to the RealPlayer app to open the URL, that's a very easy win that doesn't encumber Composr in any way.
- I have not removed plugin whitelisting, as I want the general compatibility mode for legacy video to still be able to draw on whatever video plugins happen to be available still

I think this is a reasonable balance. We're removing explicit support for a few formats, but we're not erasing them from history and breaking mime type and plugin handling that may happen to automatically route through for them still.

I have also rationalised file type lists in a few places, with a new automated test making sure all our file type whitelisting is consistent.

I have also added 'cur' as a valid image format (cursor, referenced in CSS).

When we drop IE11 support we can use 308 redirects and eliminate the REDIRECT_POST_METHOD_SCREEN template.

Here are a couple of useful resources to see what is coming up:
https://mozilla.github.io/standards-positions/
https://caniuse.com/

We need to ensure the documentation (tut_markup) is updated when a new standalone web standard is implemented.

I have marked some code in the JavaScript as LEGACY, where I know modern browsers basically won't need that code.

It would be very nice to use ES6 classes and default values and arrow functions. Here is a tool to automatically use them: https://github.com/lebab/lebab
tut_javascript.txt would need updating to reflect that our $util.properties syntax would no longer be needed.

There is input type="url" which we do not currently use, but could.
https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/url

Note that this will add strictness that may not currently exist. Currently the authors form uses form_input_line to input the author URL/email-address. If that were to switch to form_input_url, we'd need to not allow email's without mailto which probably would make things worse rather than better.
This issue may exist in other fields that do actually use form_input_url, so they'd need careful checking.