Arbitrary `/tmp` read in discourse via `convert_heif!` decoder-confusion (regression of 4bf3bf6786)

`convert_heif!` shells `magick` without `prepend_decoder!`, so ImageMagick dispatches by magic bytes. A `.heic` starting with `%!PS-Adobe` routes through the PostScript coder → Ghostscript (`-dSAFER`), which runs attacker PostScript: read any `/tmp` file with `file`/`readstring`, enumerate with …

# app/models/optimized_image.rb:198
IM_DECODERS = /\A(jpe?g|png|ico|gif|webp|avif|svg)\z/i

# :200
def self.prepend_decoder!(path, ext_path = nil, opts = nil)
  …
  if !extension || !extension.match?(IM_DECODERS)
    raise Discourse::InvalidAccess.new("Unsupported extension: #{extension}")
  end …