Document SVG denial in generated project upload defaults

[pwizla]

This PR updates documentation based on strapi/strapi#27360.

Adds a "SVG upload security" section to the Upload REST API page (cms/api/rest/upload.md) documenting:

• That image/svg+xml is denied by default in projects generated with create-strapi-app, even though image/* is in allowedTypes
• The rationale: SVG can contain browser-active content (scripts, event handlers)
• That explicit deniedTypes entries take precedence over wildcards in allowedTypes
• That this applies to new projects only — existing projects are not affected
• How to allow SVG uploads if needed (with a security caveat)
• A cross-link to the full security configuration reference in the Media Library docs

Generated automatically by the docs self-healing workflow.
Review before merging.

[strapi-cla]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ pwizla
❌ github-actions[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
documentation	Error		Aug 21, 2026 12:40pm