case 4727 - logo uploads checked by content, change rights, served sandboxed

Logo upload and delete need change rights on Global (was read rights,
which BizAdminRestricted has). The image type is taken from the bytes:
PNG, JPEG, GIF, WebP or SVG, anything else refused; the claimed type is
not stored. Downloads send nosniff and a sandbox Content-Security-Policy,
so an SVG opened by its URL runs no script. F23 fixed (4727 step 1).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/8.0/ayanova/docs/adm-global-logo.md

@@ -29,6 +29,10 @@ Logos are stored in the AyaNova database and appear in reports and on the login
 If you do not want to customize the login form and only want a logo for reporting then you would only need to provide the Small sized logo.
 If you provide a Medium or Large sized logo they will automatically be used by the Login form in place of the standard AyaNova logo.
 
+### Logo file types
+
+Logos must be PNG, JPEG, GIF, WebP or SVG images. Other files are refused when uploaded.
+
 ### Maximum logo file size
 
 Maximum file size allowed for any logo is 512KiB (512000 bytes) however you should ensure your logo is as small a file size as possible while still maintaining visual quality. Under 100kb is a good rule of thumb.

docs/8.0/ayanova/docs/changelog.md

@@ -28,6 +28,7 @@ IN PROGRESS
 - Server: removed an unused internal performance profiling component.
 - Server: AyaNova now checks the email (SMTP) server's security certificate when sending email. If your mail server uses a self-signed or internal certificate and email notifications stop after upgrading, see [SMTP certificate check](ops-config-smtp-accept-any-certificate.md).
 - Server: after repeated failed login attempts, further attempts for that login, or from that address, are refused for a few minutes.
+- Server: business logo uploads must be PNG, JPEG, GIF, WebP or SVG images, and need full rights to global settings. See [business logos](adm-global-logo.md).
 - Server: when a user's password is reset or set by an administrator, or their login is disabled, they are signed out and must sign in again.
 - Server: on a server with a purchased license, the SuperUser account can only be used to change its password while it still has the default password, and the login form no longer offers the default SuperUser login. See [SuperUser login](ay-start-login.md).
 - Server: the SMTP server password is no longer shown in the [notification settings](ops-notification-system.md) form; it shows `********` when a password is set. Type a new password to change it.