Disallow unsupported image formats from image-rs
#1060 (closed) has a fuzzed PNM as a data:
URI. In theory librsvg should only allow PNG/JPEG/GIF/WEBP per image_format()
in document.rs
, but that check only happens if the data:
URI actually specifies a content-type. In this case, it doesn't, and the code falls back to the sniffing that image-rs does.
We should only allow supported formats even for sniffed ones.