feat: remove .html and .svg from allowed upload types and MIME mappings

Remove HTML and SVG file extensions from the ALLOWED_UPLOAD_TYPES dictionary and their corresponding MIME type entries from MIME_TO_EXT in attachments.py, preventing users from uploading these potentially unsafe file formats through the API.

tests/e2e/comments/delete.py

@@ -47,7 +47,7 @@ def test_delete_comment_scrolls_to_previous_comment(alice):
     expect(page.locator(f".comment-text:has-text('{target}')")).to_have_count(0)
 
     page.wait_for_function(
-        "expected => Math.abs(window.scrollY - expected) < 120",
+        "expected => { const max = document.documentElement.scrollHeight - window.innerHeight; return Math.abs(window.scrollY - Math.min(expected, max)) < 120; }",
         arg=anchor_top,
     )
     expect(previous_wrapper).to_be_visible()