Fix: Add Sandbox to Image Headers

[Gykes]

Description

Previously, SVG images were not sandboxed so they could run embedded scripts within Stash context. This adds a sandbox and various other verification steps to prevent this from happening but still allow SVGs to be used as images within stash.

Related Issue

N/A

Testing

Dev tests were completed

Curl example with my own "malicious" svg. The SVG is injected with some malicious code but the script is not ran. The images still loads appropriatly

 HTTP/1.1 200 OK                                                                                     
  Accept-Ranges: bytes                                                                                
  Cache-Control: no-cache                                                                             
  Content-Length: 937                                                                                 
  Content-Security-Policy: default-src 'none'; img-src data:; style-src 'unsafe-inline'; sandbox      
  Content-Type: image/svg+xml                                                                         
  Etag: "6313e9d02fb4c18b14078dba234f176c"                                                            
  Vary: Origin                                                                                        
  X-Content-Type-Options: nosniff                                                                     
  Date: Wed, 19 Aug 2026 21:51:45 GMT                                                                 
                                                                                                      
  <svg xmlns="http://www.w3.org/2000/svg" width="400" height="200" viewBox="0 0 400 200">             
    <rect width="400" height="200" fill="#1b212b"/>                                                   
    <circle cx="60" cy="100" r="34" fill="#c23a4b"/>                                                  
    <text x="110" y="95" fill="#8fd18f" font-family="monospace" font-size="18">benign image</text>    
    <text x="110" y="120" fill="#7c8695" font-family="monospace" font-size="12">script blocked =      
  safe</text>                                                                                         
    <script type="text/javascript">                                                                   
      // benign test payload - visible + console side effects only, no network                        
      console.log('XSS_FIRED');                                                                       
      document.title = 'PWNED';                                                                       
      var t = document.createElementNS('http://www.w3.org/2000/svg', 'text');                         
      t.setAttribute('x', '110'); t.setAttribute('y', '160');                                         
      t.setAttribute('fill', '#f0616f');                                                              
      t.setAttribute('font-family', 'monospace');                                                     
      t.setAttribute('font-size', '20');                                                              
      t.textContent = 'XSS FIRED - script ran!';                                                      
      document.documentElement.appendChild(t);                                                        
    </script>                                                                                         
  </svg> 

Screenshots

NA

Checklist

• I have read and understood the Contributing document.
• I have read and understood the AI Usage Policy document.
• I have made corresponding changes to the documentation (if applicable).

AI Usage Disclosure

• I have used AI tools to assist with this pull request, and I have disclosed the tools and how I used them below.

Claude Opus was used to help build the test and the malicious test SVG.

Additional Context

Thanks to Nynxz for reporting this!!