fix(security): Force Imagick to only accept HEIC/HEIF images

[fabianzw]

• Resolves: Secure heic/heif image preview provider #58393

Summary

The HEIC preview provider was disabled in the past due to security issues (HackerOne, #28077). While #44710 added MIME-checking as a security measure, the reliability of these checks is debatable. Furthermore, malicious files cause Imagick's pingImage to attempt unauthorized file access even before the check occurs (see below). This PR restricts Imagick to only accept HEIC/HEIF files, strengthening the defense against SVG SSRF attacks.

The issue with pingImage

When targeted by an SVG SSRF attack, Imagick's pingImage attempts to access files before the MIME type is verified. For a file named malicious.heic with the following content:
<?xml version="1.0" encoding="UTF-8" standalone="no"?> <svg xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" style="overflow: hidden; position: relative;" width="500" height="500"> <image x="0" y="0" width="500" height="500" xlink:href="/var/www/html/secret.png" stroke-width="1" id="image3204" /> </svg>
pingImage will throw an exception if secret.png does not exist. I.e.:
nextcloud-1 | {(..) "message":"File: /admin/files/malicious.heic Imagick says:" (..) "occ_command":["occ","preview:generate-all"],"exception":{"Exception":"ImagickException","Message":"unable to open image '/var/www/html/secret.png': No such file or directory (..)
TThe preview code should fail consistently regardless of whether secret.png exists. It should not try to access secret.png at all. With this PR, the preview will always fail like:
nextcloud-1 | {(..) "message":"File: /admin/files/malicious.heic Imagick says:" (..) "occ_command":["occ","preview:generate-all"],"exception":{"Exception":"ImagickException","Message":"ImageTypeNotSupported /var/www/html/data/admin/files/malicious.heic'

Mislabeled files

#44710 attempted to preserve preview generation for JPEG/PNG files incorrectly ending in .heic. This functionality is removed by the stricter Imagick check. This is unlikely to be a common issue; I would prefer to reduce attack surface. For clarity, I removed JPEG, PNG etc. from the allowed MIME types. In theory, the MIME check is redundant as non-HEIC/HEIF images will fail in pingImage. I decided to leave it in the code, but I can also remove it, if wanted.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)