Resolve findings from the security hardening audit

[jakejackson1]

The 4.0.0 security hardening release, with the findings from a follow-up audit of the work folded in.

Storage writes each upload to a staged file and moves it into place rather than writing to the destination directly, applies a default extension deny-list, and refuses traversal, dotfiles, control characters and symlinked destinations. Validation\FileType pairs an extension with the media type sniffed from the contents. Filenames and extensions are sanitized, stored files get mode 0640, and upload() now requires something to validate against.

Two things to know before merging:

• Defaults changed and can reject uploads 3.x accepted. UPGRADE.md is the step-by-step guide.
• The deny-list can refuse names you'd consider ordinary. It matches a blocked word anywhere between dots, so release.config.zip is refused. UPGRADE.md has the snippet to narrow the list.

Full detail in CHANGELOG.md, UPGRADE.md and the README.