🐛(back) allow only images to be used with the cors-proxy

The cors-proxy endpoint allowed to use every type of files and to
execute it in the browser. We limit the scope only to images and
Content-Security-Policy and Content-Disposition headers are also added
to not allow script execution that can be present in a SVG file.

CHANGELOG.md

@@ -8,8 +8,14 @@ and this project adheres to
 
 ## [Unreleased]
 
+## Added
+
 - 📝(doc) add publiccode.yml
 
+## Fixed
+
+- 🐛(back) allow only images to be used with the cors-proxy #781
+
 ## [2.5.0] - 2025-03-18
 
 ## Added