Contrary to what I thought the expected icon is an icon that can be masked, not
the mask itself.

It must be served from the same origin, so we need to bypass the CDN we use for
meet.jit.si. See the code comments for the rationale on the workaround.

Make it a 512 square and specify its purpose as just "maskable" since this can't
go anywhere.