activitypub: fetch_object_from_id(): prefer `actor` over `attributedTo` to avoid spoofing

2 jobs for security/actor-containment in 7 minutes and 20 seconds (queued for 3 seconds)