Allow image style generations for unmanaged remote files

Just came across this as we've got a similar need.
I think we could rely on the Image Derivative Token handling already in core - if it's deemed secure enough.
Having a valid itok parameter indicates that the url was generated by our very own instance which should count pretty much as "managed".
One could probably argue about the cryptographic strength of the core token - as its goal is to prevent DOS and not essentially fending off proxying.