fix(GRO-642): restrict allowed logo MIME types to bitmap formats only

Exclude image/svg+xml from the frontend allowlist since SVG poses greater
XSS risk due to its ability to contain scripts, even with proper Content-Type
validation. The server-side validation (commit 8182870) still accepts SVG
and validates magic bytes, but the frontend restrict to safer bitmap formats
as specified in the issue.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/web/src/pages/Settings.tsx

@@ -27,7 +27,7 @@ interface AuthProviderForm {
 
 const REDACTED = "••••••••";
 
-const ALLOWED_LOGO_TYPES = new Set(["image/png", "image/jpeg", "image/gif", "image/webp", "image/svg+xml"]);
+const ALLOWED_LOGO_TYPES = new Set(["image/png", "image/jpeg", "image/gif", "image/webp"]);
 
 interface CurrentUser {
   id: string;