fix: XSS vulnerability due to polyglot file type upload

[guqing]

What type of PR is this?

/kind bug
/area core
/milestone 2.20.x

What this PR does / why we need it:

修复文件类型限制能通过混合文件类型绕过检测的问题

参考：https://github.com/halo-dev/halo/security/advisories/GHSA-99mc-ch53-pqh9

Does this PR introduce a user-facing change?

修复文件类型限制能通过混合文件类型绕过检测的问题

[codecov]

Codecov Report

Attention: Patch coverage is 0% with 18 lines in your changes missing coverage. Please review.

Project coverage is 57.17%. Comparing base (eff73dc) to head (59b51eb).
Report is 83 commits behind head on main.

Files with missing lines	Patch %	Lines
.../run/halo/app/infra/utils/FileTypeDetectUtils.java	0.00%	12 Missing ⚠️
...achment/endpoint/LocalAttachmentUploadHandler.java	0.00%	6 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #7149      +/-   ##
============================================
+ Coverage     56.99%   57.17%   +0.17%     
- Complexity     3999     4047      +48     
============================================
  Files           714      719       +5     
  Lines         24110    24369     +259     
  Branches       1585     1600      +15     
============================================
+ Hits          13742    13932     +190     
- Misses         9756     9820      +64     
- Partials        612      617       +5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[JohnNiang]

/ping @halo-dev/sig-halo

[ruibaby]

/lgtm

[f2c-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ruibaby

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [ruibaby]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment