feat: remove .html and .svg from allowed upload types and MIME mappings

Remove HTML and SVG file extensions from the ALLOWED_UPLOAD_TYPES dictionary and their corresponding MIME type entries from MIME_TO_EXT in attachments.py, preventing users from uploading these potentially unsafe file formats through the API.

tests/e2e/issues/create.py

@@ -8,8 +8,15 @@ SPINNER = "#create-issue-modal button[type='submit'] .btn-spinner"
 
 def _open_form(page):
     page.goto(f"{BASE_URL}/issues", wait_until="domcontentloaded")
-    page.click("button:has-text('Report Issue')")
-    page.fill("#issue-title", "Spinner regression title")
+    trigger = page.locator("button:has-text('Report Issue')")
+    title = page.locator("#issue-title")
+    trigger.click()
+    try:
+        title.wait_for(state="visible", timeout=5000)
+    except Exception:
+        trigger.click()
+        title.wait_for(state="visible", timeout=10000)
+    title.fill("Spinner regression title")
     page.fill("#issue-description", "Steps to reproduce the spinner regression")