[BUG] Org may fetch remote content without asking user consent

[Max Nikulin]

Consider the following .org file:

--- 8< ---
#+setupfile: /dav:localhost#8000:/msg-123456.org
--- >8 ---

When Emacs opens it, HTTP server (plain HTTP, not WebDAV is used for 
test) logs contain

python3 -m http.server 8000
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
127.0.0.1 - - [07/Feb/2024 17:34:52] code 501, message Unsupported 
method ('OPTIONS')
127.0.0.1 - - [07/Feb/2024 17:34:52] "OPTIONS /msg-123456.org HTTP/1.1" 
501 -
127.0.0.1 - - [07/Feb/2024 17:34:52] code 501, message Unsupported 
method ('OPTIONS')
127.0.0.1 - - [07/Feb/2024 17:34:52] "OPTIONS /msg-123456.org HTTP/1.1" 
501 -

Emacs *Messages* buffer:

Tramp: Opening connection for localhost using dav...failed
Unable to read file "/dav:localhost#8000:/msg-123456.org"
Tramp: Opening connection for localhost using dav...failed
Unable to read file "/dav:localhost#8000:/msg-123456.org"

No dialog whether the file should be downloaded is displayed.

My expectation is that Org should not connect to remote servers in 
default configuration unless it is explicitly approved by the user.

I am unsure what user option may be changed to mitigate the issue.

- Debian 12 bookworm
- Org commit 18d98e
- gvfs-backends (dependency of gnome-core) package is installed