Parts labelled application/octet-stream or image/octet-stream are identified from their bytes; only a raster type on the allow-list can come out, so SVG and HTML stay downloads. Part of #213.
Co-authored-by: MontyWei <62734446+montywei@users.noreply.github.com>