Filter SVGs before uploading by default

Creating this as a postponed followup to #2868079: Add a default Content-Security-Policy-header for svg files → to provide a more robust solution to a wider set of problems.

The SVG Image → module does sanitization in the Formatter. https://git.drupalcode.org/project/svg_image/-/blob/3.x/src/Plugin/Field...

One option, but not a very practical one, is to save SVG files as private files, not public. Then (somehow) Drupal could sanitize them on output.

I think a better option is to provide a file validator using a suitable PHP library. Then site owners and contrib module maintainers would have the option of adding SVG validation to any field that allows uploading SVG files. We could recommend using it and add it to the Standard and/or Umami profiles. But site owners would have the freedom to use it or not.

This option requires finding a suitable library that implements something like isSvgSafe(), returning bool. I have not researched such libraries.

One concern I have heard is that new vulnerabilities might be discovered in SVG files. The library we use might be updated, preventing new uploads of malicious files, but that would not help if such files have already been uploaded. I think a good way to deal with that would be to provide a field formatter that returns a boolean (Safe or Unsafe). We could add that formatter to /admin/content/files. After updates to the SVG library, site owners could filter on that value to search for existing, unsafe SVG files.