Do not allow file type spoofing if the header bytes are not recognized

[locriani]

This fixes an issue raised in #1934, where a malicious user could bypass the stricter mime-type checking by choosing header bytes that are not recognized by the mimemagic gem.

[myers]

I think you are on the right path here. One concern I have after testing 0.11.3 in my own app, is that existing_content_type trust what @file says about itself. When you are uploading a file this is an instance of ActionDispatch::Http::UploadedFile which has the content type set to a value form the browser, which shouldn't be trusted. I think content_type should only trust mime_magic_content_type.