Limit content type of images

[joelvdavies]

Images should only be uploaded with a content type such as image/*. If we were uploading them the same was as for attachments we could for example use a condition like ["starts-with", "$Content-Type", "image/"])). We should at least

• Reject requests that use an image content type that doesn't start with images/
• Investigate whether it is worth further limiting them to further specific types