Replace the image/ prefix match with an explicit allowlist of safe binary MIME types. SVG is intentionally excluded as it supports embedded scripts. Normalize the knot-supplied Content-Type with mime.ParseMediaType before classification to strip parameters and prevent bypass attempts. Add X-Content-Type-Options: nosniff as defence-in-depth. Add tests covering the allowlist invariants and the normalization behaviour. Signed-off-by: Matías Insaurralde <matias@insaurral.de>