Use stricter checking for CSV

[davidmegginson]

• apply a blocklist of MIME types (if present) and file extensions
• check that at least n rows in the first 25 split into multiple fields using the detected delimiter
• look for non-printing UNICODE characters

[davidmegginson]

Note that XLSX_MIME_TYPES and XLS_MIME_TYPES are never used.

[davidmegginson]

Note that we can't trust the XLSX and XLS mime types, because servers sometimes server out CSV with them (and even with .xls or .xlsx file extensions).

[davidmegginson]

We no longer fall back to CSV if there's a MIME type or file extension and it's not in the allow list. This prevents trying to process (e.g.) a png file.